Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1381190

[PATCH 4.5 047/124] ath9k: fix buffer overrun for ar9287

Show all headers | View raw

4.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 83d6f1f15f8cce844b0a131cbc63e444620e48b5 ]

Code that was added back in 2.6.38 has an obvious overflow
when accessing a static array, and at the time it was added
only a code comment was put in front of it as a reminder
to have it reviewed properly.

This has not happened, but gcc-6 now points to the specific
overflow:

drivers/net/wireless/ath/ath9k/eeprom.c: In function 'ath9k_hw_get_gain_boundaries_pdadcs':
drivers/net/wireless/ath/ath9k/eeprom.c:483:44: error: array subscript is above array bounds [-Werror=array-bounds]
     maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
                   ~~~~~~~~~~~~~~~~~~~~~~~~~^~~

It turns out that the correct array length exists in the local
'intercepts' variable of this function, so we can just use that
instead of hardcoding '4', so this patch changes all three
instances to use that variable. The other two instances were
already correct, but it's more consistent this way.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 940cd2c12ebf ("ath9k_hw: merge the ar9287 version of ath9k_hw_get_gain_boundaries_pdadcs")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath9k/eeprom.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -477,10 +477,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs
 
 	if (match) {
 		if (AR_SREV_9287(ah)) {
-			/* FIXME: array overrun? */
 			for (i = 0; i < numXpdGains; i++) {
 				minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
-				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
+				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
 						data_9287[idxL].pwrPdg[i],
 						data_9287[idxL].vpdPdg[i],
@@ -490,7 +489,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs
 		} else if (eeprom_4k) {
 			for (i = 0; i < numXpdGains; i++) {
 				minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
-				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
+				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
 						data_4k[idxL].pwrPdg[i],
 						data_4k[idxL].vpdPdg[i],
@@ -500,7 +499,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs
 		} else {
 			for (i = 0; i < numXpdGains; i++) {
 				minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
-				maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
+				maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
 						data_def[idxL].pwrPdg[i],
 						data_def[idxL].vpdPdg[i],

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.5 000/124] 4.5.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 045/124] mlx4: add missing braces in verify_qp_parameters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 007/124] parisc: Unbreak handling exceptions from kernel modules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 047/124] ath9k: fix buffer overrun for ar9287 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 024/124] drm/radeon: add another R7 370 quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 043/124] ipv4: Dont do expensive useless work during inetdev destroy. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 041/124] rocker: set FDB cleanup timer according to lowest ageing time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 054/124] ipv4: fix broadcast packets reception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 052/124] net: bcmgenet: fix dma api length mismatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 035/124] sh_eth: fix NULL pointer dereference in sh_eth_ring_format() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:40 +0200
  [PATCH 4.5 011/124] ALSA: hda - Apply fix for white noise on Asus N550JV, too Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 013/124] mm: fix invalid node in alloc_migrate_target() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 020/124] arm64: opcodes.h: Add arm big-endian config options before including arm header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 010/124] ALSA: hda - Fix white noise on Asus N750JV headphone Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 015/124] s390/mm: handle PTE-mapped tail pages in fast gup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 018/124] powerpc/process: Fix altivec SPR not being saved Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 003/124] parisc: Fix SIGSYS signals in compat case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 006/124] parisc: Fix kernel crash with reversed copy_from_user() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 019/124] compiler-gcc: disable -ftracer for __noclone functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  [PATCH 4.5 016/124] libnvdimm: fix smart data retrieval Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
  Re: [PATCH 4.5 000/124] 4.5.2-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-18 18:40 +0200
    Re: [PATCH 4.5 000/124] 4.5.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-19 08:00 +0200
  Re: [PATCH 4.5 000/124] 4.5.2-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-04-18 18:40 +0200
    Re: [PATCH 4.5 000/124] 4.5.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-19 08:00 +0200
  Re: [PATCH 4.5 000/124] 4.5.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-19 08:00 +0200

csiph-web