Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2636c308 authored by Amitkumar Karwar's avatar Amitkumar Karwar Committed by John W. Linville
Browse files

mwifiex: fix invalid memory access in mwifiex_ret_tx_rate_cfg() 



As tlv_buf_len is decremented at the end of the loop, we may have
accessed invalid memory in the last iteration.
Modify the while condition and add a break statement at the
begining of the loop to fix the problem.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: default avatarBing Zhao <bzhao@marvell.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent fe1c9a44

drivers/net/wireless/mwifiex/sta_cmdresp.c

+12 −10
Original line number Diff line number Diff line
@@ -274,17 +274,20 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv, 
	struct host_cmd_ds_tx_rate_cfg *rate_cfg = &resp->params.tx_rate_cfg;

	struct mwifiex_rate_scope *rate_scope;

	struct mwifiex_ie_types_header *head;

	u16 tlv, tlv_buf_len;

	u16 tlv, tlv_buf_len, tlv_buf_left;

	u8 *tlv_buf;

	u32 i;



	tlv_buf = ((u8 *)rate_cfg) +

			sizeof(struct host_cmd_ds_tx_rate_cfg);

	tlv_buf_len = le16_to_cpu(*(__le16 *) (tlv_buf + sizeof(u16)));

	tlv_buf = ((u8 *)rate_cfg) + sizeof(struct host_cmd_ds_tx_rate_cfg);

	tlv_buf_left = le16_to_cpu(resp->size) - S_DS_GEN - sizeof(*rate_cfg);



	while (tlv_buf && tlv_buf_len > 0) {

		tlv = (*tlv_buf);

		tlv = tlv | (*(tlv_buf + 1) << 8);

	while (tlv_buf_left >= sizeof(*head)) {

		head = (struct mwifiex_ie_types_header *)tlv_buf;

		tlv = le16_to_cpu(head->type);

		tlv_buf_len = le16_to_cpu(head->len);



		if (tlv_buf_left < (sizeof(*head) + tlv_buf_len))

			break;



		switch (tlv) {

		case TLV_TYPE_RATE_SCOPE:
@@ -304,9 +307,8 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv, 
			/* Add RATE_DROP tlv here */

		}



		head = (struct mwifiex_ie_types_header *) tlv_buf;

		tlv_buf += le16_to_cpu(head->len) + sizeof(*head);

		tlv_buf_len -= le16_to_cpu(head->len);

		tlv_buf += (sizeof(*head) + tlv_buf_len);

		tlv_buf_left -= (sizeof(*head) + tlv_buf_len);

	}



	priv->is_data_rate_auto = mwifiex_is_rate_auto(priv);