From patchwork Tue Nov 27 08:21:32 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Manoharan, Rajkumar" X-Patchwork-Id: 1809231 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 076043FCF6 for ; Tue, 27 Nov 2012 08:21:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757407Ab2K0IVY (ORCPT ); Tue, 27 Nov 2012 03:21:24 -0500 Received: from sabertooth02.qualcomm.com ([65.197.215.38]:43131 "EHLO sabertooth02.qualcomm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753549Ab2K0IVX (ORCPT ); Tue, 27 Nov 2012 03:21:23 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qca.qualcomm.com; i=@qca.qualcomm.com; q=dns/txt; s=qcdkim; t=1354002957; x=1385538957; h=from:to:cc:subject:date:message-id:mime-version; bh=nHymN2tKRxfzMoUHnhs1dH10ylEktc6Oay1Qo4YlaIQ=; b=kha3OcPIvf33usZ9K8F9HjpznVTp772URD0JQHRIWDUD29gSIwpEDi+D HLgkxro7wtXNd6spmnbuL4wSnrKz/WTkEsXYVZgwiq6MpVkaZqPN7tC/Y seQiYJmvlK5dvUIx6nirarKOe0OK+1AKOHYAsejBdEpSR4GjhrQbwF68j A=; X-IronPort-AV: E=McAfee;i="5400,1158,6908"; a="9202024" Received: from ironmsg01-lv.qualcomm.com ([10.47.202.180]) by sabertooth02.qualcomm.com with ESMTP; 26 Nov 2012 23:55:56 -0800 X-IronPort-AV: E=McAfee;i="5400,1158,6908"; a="2461619" Received: from nasanexhc08.na.qualcomm.com ([172.30.39.7]) by ironmsg01-lv.qualcomm.com with ESMTP/TLS/RC4-SHA; 27 Nov 2012 00:21:22 -0800 Received: from qcmail1.qualcomm.com (172.30.39.5) by qcmail1.qualcomm.com (172.30.39.7) with Microsoft SMTP Server (TLS) id 14.2.318.4; Tue, 27 Nov 2012 00:21:21 -0800 Received: by qcmail1.qualcomm.com (sSMTP sendmail emulation); Tue, 27 Nov 2012 13:51:32 +0530 From: Rajkumar Manoharan To: CC: , Rajkumar Manoharan Subject: [PATCH] ath9k: Fix buffer overflow error Date: Tue, 27 Nov 2012 13:51:32 +0530 Message-ID: <1354004492-369-1-git-send-email-rmanohar@qca.qualcomm.com> X-Mailer: git-send-email 1.8.0.1 MIME-Version: 1.0 X-Originating-IP: [172.30.39.5] Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org The commit "ath9k: stomp audio profiles on weak signal strength" failed to take care of new stomp type while programming concurrent tx priority. That leads to array index out of bounds access. drivers/net/wireless/ath/ath9k/btcoex.c:414 ath9k_hw_btcoex_set_concur_txprio() error: buffer overflow 'stomp_txprio' 4 <= 4 Reported-by: Dan Carpenter Signed-off-by: Rajkumar Manoharan --- drivers/net/wireless/ath/ath9k/mci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c index 706378e..5c02702 100644 --- a/drivers/net/wireless/ath/ath9k/mci.c +++ b/drivers/net/wireless/ath/ath9k/mci.c @@ -257,8 +257,9 @@ static void ath_mci_set_concur_txprio(struct ath_softc *sc) { struct ath_btcoex *btcoex = &sc->btcoex; struct ath_mci_profile *mci = &btcoex->mci; - u8 stomp_txprio[] = { 0, 0, 0, 0 }; /* all, low, none, low_ftp */ + u8 stomp_txprio[ATH_BTCOEX_STOMP_MAX]; + memset(stomp_txprio, 0, sizeof(stomp_txprio)); if (mci->num_mgmt) { stomp_txprio[ATH_BTCOEX_STOMP_ALL] = ATH_MCI_INQUIRY_PRIO; if (!mci->num_pan && !mci->num_other_acl)