Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e8b3f7b6 authored by Eyal Shapira's avatar Eyal Shapira Committed by Emmanuel Grumbach
Browse files

iwlwifi: mvm: rs: fix a potential out of bounds access 



Klocwork pointed these out. There is a theoretical possibility
that rate->index might be set to IWL_RATE_INVALID (15).
This could trigger an out of bounds access on ht_vht_rates or
legacy_rates arrays. Fix it by adding some checks.

Signed-off-by: default avatarEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
parent 355346ba

drivers/net/wireless/intel/iwlwifi/mvm/rs.c

+3 −2
Original line number Diff line number Diff line
@@ -552,9 +552,10 @@ static char *rs_pretty_rate(const struct rs_rate *rate) 
	};

	const char *rate_str;



	if (is_type_legacy(rate->type))

	if (is_type_legacy(rate->type) && (rate->index <= IWL_RATE_54M_INDEX))

		rate_str = legacy_rates[rate->index];

	else if (is_type_ht(rate->type) || is_type_vht(rate->type))

	else if ((is_type_ht(rate->type) || is_type_vht(rate->type)) &&

		 (rate->index <= IWL_RATE_MCS_9_INDEX))

		rate_str = ht_vht_rates[rate->index];

	else

		rate_str = "BAD_RATE";