From patchwork Tue Aug 18 07:57:29 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Emmanuel Grumbach X-Patchwork-Id: 7029121 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 0074F9F344 for ; Tue, 18 Aug 2015 07:58:35 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 31C7920755 for ; Tue, 18 Aug 2015 07:58:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 505F0206EF for ; Tue, 18 Aug 2015 07:58:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752292AbbHRH6a (ORCPT ); Tue, 18 Aug 2015 03:58:30 -0400 Received: from mga11.intel.com ([192.55.52.93]:39253 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752225AbbHRH61 (ORCPT ); Tue, 18 Aug 2015 03:58:27 -0400 Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga102.fm.intel.com with ESMTP; 18 Aug 2015 00:58:27 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.15,700,1432623600"; d="scan'208";a="785867343" Received: from egrumbacbox.jer.intel.com ([10.12.124.229]) by fmsmga002.fm.intel.com with ESMTP; 18 Aug 2015 00:58:24 -0700 From: Emmanuel Grumbach To: linux-wireless@vger.kernel.org Cc: Dan Carpenter , Emmanuel Grumbach Subject: [PATCH 19/26] iwlwifi: mvm: fix a range check in debugfs code Date: Tue, 18 Aug 2015 10:57:29 +0300 Message-Id: <1439884656-18146-19-git-send-email-emmanuel.grumbach@intel.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <0BA3FCBA62E2DC44AF3030971E174FB32E8110F8@hasmsx107.ger.corp.intel.com> References: <0BA3FCBA62E2DC44AF3030971E174FB32E8110F8@hasmsx107.ger.corp.intel.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Dan Carpenter The &mvm->tof_data.range_req.ap[] array has IWL_MVM_TOF_MAX_APS elements so the check should be >= instead of >. Also the test can underflow so I have changed "i" to unsigned. Fixes: ce7929186a39 ('wlwifi: mvm: add basic Time of Flight (802.11mc FTM) support') Signed-off-by: Dan Carpenter Signed-off-by: Emmanuel Grumbach --- drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c index ddb1c84..383a316 100644 --- a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c +++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c @@ -911,9 +911,9 @@ static ssize_t iwl_dbgfs_tof_range_request_write(struct ieee80211_vif *vif, int size = sizeof(struct iwl_tof_range_req_ap_entry); u16 burst_period; u8 *mac = ap.bssid; - int i; + unsigned int i; - if (sscanf(data, "%d %hhd %hhx %hhx" + if (sscanf(data, "%u %hhd %hhx %hhx" "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx" "%hhx %hhx %hx" "%hhx %hhx %x" @@ -929,7 +929,7 @@ static ssize_t iwl_dbgfs_tof_range_request_write(struct ieee80211_vif *vif, ret = -EINVAL; goto out; } - if (i > IWL_MVM_TOF_MAX_APS) { + if (i >= IWL_MVM_TOF_MAX_APS) { IWL_ERR(mvm, "Invalid AP index %d\n", i); ret = -EINVAL; goto out;