| From: Colin Ian King <colin.king@canonical.com> |
| Date: Sun, 26 Jan 2020 00:09:54 +0000 |
| Subject: iwlegacy: ensure loop counter addr does not wrap and cause an |
| infinite loop |
| |
| commit c2f9a4e4a5abfc84c01b738496b3fd2d471e0b18 upstream. |
| |
| The loop counter addr is a u16 where as the upper limit of the loop |
| is an int. In the unlikely event that the il->cfg->eeprom_size is |
| greater than 64K then we end up with an infinite loop since addr will |
| wrap around an never reach upper loop limit. Fix this by making addr |
| an int. |
| |
| Addresses-Coverity: ("Infinite loop") |
| Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965") |
| Signed-off-by: Colin Ian King <colin.king@canonical.com> |
| Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| [bwh: Backported to 3.16: adjust filename] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/net/wireless/iwlegacy/common.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/net/wireless/iwlegacy/common.c |
| +++ b/drivers/net/wireless/iwlegacy/common.c |
| @@ -717,7 +717,7 @@ il_eeprom_init(struct il_priv *il) |
| u32 gp = _il_rd(il, CSR_EEPROM_GP); |
| int sz; |
| int ret; |
| - u16 addr; |
| + int addr; |
| |
| /* allocate eeprom */ |
| sz = il->cfg->eeprom_size; |
