Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dc33bd43 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: rtlwifi: check for array overflow 



Smatch is distrustful of the "capab" value and marks it as user
controlled.  I think it actually comes from the firmware?  Anyway, I
looked at other drivers and they added a bounds check and it seems like
a harmless thing to have so I have added it here as well.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cec8bb22

drivers/staging/rtlwifi/base.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -1414,6 +1414,10 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx) 
				  le16_to_cpu(mgmt->u.action.u.addba_req.capab);

				  le16_to_cpu(mgmt->u.action.u.addba_req.capab);

				tid = (capab &

				tid = (capab &

				       IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;

				       IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;

				if (tid >= MAX_TID_COUNT) {

					rcu_read_unlock();

					return true;

				}

				tid_data = &sta_entry->tids[tid];

				tid_data = &sta_entry->tids[tid];

				if (tid_data->agg.rx_agg_state ==

				if (tid_data->agg.rx_agg_state ==

				    RTL_RX_AGG_START)

				    RTL_RX_AGG_START)