| From 6251a276131ad0c7a40243fc6b2f7fa75e0fe922 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Thu, 4 Apr 2019 11:44:23 +0300 |
| Subject: mwifiex: prevent an array overflow |
| |
| [ Upstream commit b4c35c17227fe437ded17ce683a6927845f8c4a4 ] |
| |
| The "rate_index" is only used as an index into the phist_data->rx_rate[] |
| array in the mwifiex_hist_data_set() function. That array has |
| MWIFIEX_MAX_AC_RX_RATES (74) elements and it's used to generate some |
| debugfs information. The "rate_index" variable comes from the network |
| skb->data[] and it is a u8 so it's in the 0-255 range. We need to cap |
| it to prevent an array overflow. |
| |
| Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/marvell/mwifiex/cfp.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/drivers/net/wireless/marvell/mwifiex/cfp.c b/drivers/net/wireless/marvell/mwifiex/cfp.c |
| index bfe84e55df776..f1522fb1c1e87 100644 |
| --- a/drivers/net/wireless/marvell/mwifiex/cfp.c |
| +++ b/drivers/net/wireless/marvell/mwifiex/cfp.c |
| @@ -531,5 +531,8 @@ u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv, |
| rate_index = (rx_rate > MWIFIEX_RATE_INDEX_OFDM0) ? |
| rx_rate - 1 : rx_rate; |
| |
| + if (rate_index >= MWIFIEX_MAX_AC_RX_RATES) |
| + rate_index = MWIFIEX_MAX_AC_RX_RATES - 1; |
| + |
| return rate_index; |
| } |
| -- |
| 2.20.1 |
| |
