diff options
| author |   Kalle Valo <kvalo@qca.qualcomm.com> | 2013-03-10 07:51:29 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@qca.qualcomm.com> | 2013-03-18 13:50:19 +0200 |
| commit | 99089ab756a26c8f1be5942178bf9b3fa9ae54d6 (patch) | |
| tree | 62a524f0dd24f7b0e1d80c4e098cc036c8e280e8 /drivers | |
| parent | ath6kl: add tracing support to debug message macros (diff) | |
| download | linux-dev-99089ab756a26c8f1be5942178bf9b3fa9ae54d6.tar.xz linux-dev-99089ab756a26c8f1be5942178bf9b3fa9ae54d6.zip | |
ath6kl: add an extra band check to ath6kl_wmi_beginscan_cmd()
Dan reported that smatch found a possible issue in ath6kl_wmi_beginscan_cmd()
where we might access sc->supp_rates beyond the end. It shouldn't happen as
ar->wiphy->bands always have just the first two bands set, but add an extra
check just to be sure.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/wmi.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c index 31a308103f4c..87aefb4c4c23 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.c +++ b/drivers/net/wireless/ath/ath6kl/wmi.c @@ -2029,6 +2029,9 @@ int ath6kl_wmi_beginscan_cmd(struct wmi *wmi, u8 if_idx, if (!sband) continue; + if (WARN_ON(band >= ATH6KL_NUM_BANDS)) + break; + ratemask = rates[band]; supp_rates = sc->supp_rates[band].rates; num_rates = 0; |