diff options
| author |   Miaoqing Pan <miaoqing@codeaurora.org> | 2019-10-09 16:18:08 +0800 |
|---|---|---|
| committer |   Kalle Valo <kvalo@codeaurora.org> | 2019-10-14 11:34:20 +0300 |
| commit | c5329b2d5b8b4e41be14d31ee8505b4f5607bf9b (patch) | |
| tree | a5ffdb24c39dda8e265cd2eea2d989514db03034 /drivers/net/wireless/ath/ath10k/debug.c | |
| parent | ath10k: fix null dereference on pointer crash_data (diff) | |
| download | linux-dev-c5329b2d5b8b4e41be14d31ee8505b4f5607bf9b.tar.xz linux-dev-c5329b2d5b8b4e41be14d31ee8505b4f5607bf9b.zip | |
ath10k: fix array out-of-bounds access
If firmware reports rate_max > WMI_TPC_RATE_MAX(WMI_TPC_FINAL_RATE_MAX)
or num_tx_chain > WMI_TPC_TX_N_CHAIN, it will cause array out-of-bounds
access, so print a warning and reset to avoid memory corruption.
Tested HW: QCA9984
Tested FW: 10.4-3.9.0.2-00035
Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/ath/ath10k/debug.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath10k/debug.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c index bd2b5628f850..40baf25ac99f 100644 --- a/drivers/net/wireless/ath/ath10k/debug.c +++ b/drivers/net/wireless/ath/ath10k/debug.c @@ -1516,7 +1516,7 @@ static void ath10k_tpc_stats_print(struct ath10k_tpc_stats *tpc_stats, *len += scnprintf(buf + *len, buf_len - *len, "No. Preamble Rate_code "); - for (i = 0; i < WMI_TPC_TX_N_CHAIN; i++) + for (i = 0; i < tpc_stats->num_tx_chain; i++) *len += scnprintf(buf + *len, buf_len - *len, "tpc_value%d ", i); |