From: Eyal Shapira <eyal@xxxxxxxxxx> Klocwork pointed these out. There is a theoretical possibility that rate->index might be set to IWL_RATE_INVALID (15). This could trigger an out of bounds access on ht_vht_rates or legacy_rates arrays. Fix it by adding some checks. Signed-off-by: Eyal Shapira <eyalx.shapira@xxxxxxxxx> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> --- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c index feb775a..31b082e 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c @@ -552,9 +552,10 @@ static char *rs_pretty_rate(const struct rs_rate *rate) }; const char *rate_str; - if (is_type_legacy(rate->type)) + if (is_type_legacy(rate->type) && (rate->index <= IWL_RATE_54M_INDEX)) rate_str = legacy_rates[rate->index]; - else if (is_type_ht(rate->type) || is_type_vht(rate->type)) + else if ((is_type_ht(rate->type) || is_type_vht(rate->type)) && + (rate->index <= IWL_RATE_MCS_9_INDEX)) rate_str = ht_vht_rates[rate->index]; else rate_str = "BAD_RATE"; -- 2.5.0 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
