From patchwork Fri Oct 5 21:56:09 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Colin King X-Patchwork-Id: 10628817 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7B99515A6 for ; Fri, 5 Oct 2018 21:56:34 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 68D1629A7C for ; Fri, 5 Oct 2018 21:56:34 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5C46729BB3; Fri, 5 Oct 2018 21:56:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 12AEB29A7C for ; Fri, 5 Oct 2018 21:56:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=JKO/2e+acAn36FnqavdnLdLPWDUsnHXMGxAk0vvBOng=; b=oblcMBdOmQU89n dxT89ptQsc8W45UuS6uG8MmO/f6pCPq4H5V5TUUcpIhOhxGa2o+yHq0CbelS9jbdZHQksQd9laXOA F00QsZPMD5ljmp2BRlRyV19CKYBZsX8R3UVWmQeWY2iYR9SxglayP3FZ3SRBSbHFJKDiFRpmNLsDp S35ZBMfWXOIGrrFEqClDGG4tYOvj5UBMl/XeYFuitXDMUCtBpf1ufnga2J4sQCLMKjx0lu9s2zfRR uCalUlukk44GKZ1Q4l/r93Tj/SIl1ora3XzAXqHP3S2qwGvdySIUjEmPWzx2cUSlF/fmTvQr+idBz TcAOai72wJbar2uFrZlA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1g8Y5G-0005Gr-1F; Fri, 05 Oct 2018 21:56:30 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1g8Y5C-0005FB-3y for ath10k@lists.infradead.org; Fri, 05 Oct 2018 21:56:27 +0000 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1g8Y4w-0007qH-LI; Fri, 05 Oct 2018 21:56:10 +0000 From: Colin King To: Sriram R , Kalle Valo , "David S . Miller" , ath10k@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH][next] ath10k: fix out of bound read on array ath10k_rates Date: Fri, 5 Oct 2018 22:56:09 +0100 Message-Id: <20181005215609.13935-1-colin.king@canonical.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20181005_145626_302219_FF8F1728 X-CRM114-Status: GOOD ( 10.77 ) X-BeenThere: ath10k@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Sender: "ath10k" Errors-To: ath10k-bounces+patchwork-ath10k=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP From: Colin Ian King An out-of-bounds read on array ath10k_rates is occurring because the maximum number of elements is currently based on the size of the array and not the number of elements in the array. Fix this by using ARRAY_SIZE instead of sizeof. Detected by CoverityScan, CID#1473918 ("Out-of-bounds read") Fixes: f279294e9ee2 ("ath10k: add support for configuring management packet rate") Signed-off-by: Colin Ian King --- drivers/net/wireless/ath/ath10k/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c index 3933dd96da55..3564676e74e3 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -164,7 +164,7 @@ static int ath10k_mac_get_rate_hw_value(int bitrate) if (ath10k_mac_bitrate_is_cck(bitrate)) hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6; - for (i = 0; i < sizeof(ath10k_rates); i++) { + for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) { if (ath10k_rates[i].bitrate == bitrate) return hw_value_prefix | ath10k_rates[i].hw_value; }