diff options
| author | Raja Mani <rmani@qca.qualcomm.com> | 2012-09-21 05:38:54 -0400 |
|---|---|---|
| committer | Kalle Valo <kvalo@qca.qualcomm.com> | 2012-10-24 04:49:50 -0400 |
| commit | d54601b92fbde2a7021a844e1373ba8c778cc0a3 (patch) | |
| tree | 434ba2da87ab1916a4b3dfccc2362b0a166b970f /drivers | |
| parent | 43a06b346d1350009c8f7eaa1a2a137395874ca0 (diff) | |
ath6kl: Check for valid rate table index
There are 28 items defined in rate table array 'wmi_rate_tbl'.
The rate table index (reply->rate_index) in ath6kl_wmi_bitrate_reply_rx()
func is not checked for the valid max limit index before accessing
rate table array. There may be some incidents to get memory crashes
without safe max check. Fix this.
Found this on code review.
Signed-off-by: Raja Mani <rmani@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/wmi.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c index 64b81fd554b3..f3aeebb2fd42 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.c +++ b/drivers/net/wireless/ath/ath6kl/wmi.c | |||
| @@ -1174,6 +1174,9 @@ static int ath6kl_wmi_bitrate_reply_rx(struct wmi *wmi, u8 *datap, int len) | |||
| 1174 | rate = RATE_AUTO; | 1174 | rate = RATE_AUTO; |
| 1175 | } else { | 1175 | } else { |
| 1176 | index = reply->rate_index & 0x7f; | 1176 | index = reply->rate_index & 0x7f; |
| 1177 | if (WARN_ON_ONCE(index > (RATE_MCS_7_40 + 1))) | ||
| 1178 | return -EINVAL; | ||
| 1179 | |||
| 1177 | sgi = (reply->rate_index & 0x80) ? 1 : 0; | 1180 | sgi = (reply->rate_index & 0x80) ? 1 : 0; |
| 1178 | rate = wmi_rate_tbl[index][sgi]; | 1181 | rate = wmi_rate_tbl[index][sgi]; |
| 1179 | } | 1182 | } |