diff options
| author | Rand Deeb <rand.sec96@gmail.com> | 2024-03-13 13:17:55 +0300 |
|---|---|---|
| committer | Miri Korenblit <miriam.rachel.korenblit@intel.com> | 2025-06-25 10:57:34 +0300 |
| commit | e3ad987e9dc7d1e12e3f2f1e623f0e174cd0ca78 (patch) | |
| tree | 497b5deafcfefcb3300a1f294419fed9612f0521 /drivers/net/wireless/intel/iwlwifi/dvm/rs.c | |
| parent | iwlwifi: Add missing check for alloc_ordered_workqueue (diff) | |
| download | linux-e3ad987e9dc7d1e12e3f2f1e623f0e174cd0ca78.tar.gz linux-e3ad987e9dc7d1e12e3f2f1e623f0e174cd0ca78.zip | |
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
The 'index' variable in the rs_fill_link_cmd() function can reach
LINK_QUAL_MAX_RETRY_NUM during the execution of the inner loop. This
variable is used as an index for the lq_cmd->rs_table array, which has a
size of LINK_QUAL_MAX_RETRY_NUM, without proper validation.
Modify the condition of the inner loop to ensure that the 'index' variable
does not exceed LINK_QUAL_MAX_RETRY_NUM - 1, thereby preventing any
potential overflow issues.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Rand Deeb <rand.sec96@gmail.com>
Link: https://patch.msgid.link/20240313101755.269209-1-rand.sec96@gmail.com
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/dvm/rs.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/dvm/rs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rs.c b/drivers/net/wireless/intel/iwlwifi/dvm/rs.c index 8879e668ef0d..ed964103281e 100644 --- a/drivers/net/wireless/intel/iwlwifi/dvm/rs.c +++ b/drivers/net/wireless/intel/iwlwifi/dvm/rs.c @@ -2899,7 +2899,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv, /* Repeat initial/next rate. * For legacy IWL_NUMBER_TRY == 1, this loop will not execute. * For HT IWL_HT_NUMBER_TRY == 3, this executes twice. */ - while (repeat_rate > 0 && (index < LINK_QUAL_MAX_RETRY_NUM)) { + while (repeat_rate > 0 && index < (LINK_QUAL_MAX_RETRY_NUM - 1)) { if (is_legacy(tbl_type.lq_type)) { if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) ant_toggle_cnt++; |