diff mbox

ath9k: off by one in ath9k_hw_nvram_read_array()

Message ID 20170406051220.GA23650@mwanda (mailing list archive)
State Accepted
Commit b7dcf68f383a05567bd16a390907b67022a62d3d
Delegated to: Kalle Valo
Headers show

Commit Message

Dan Carpenter April 6, 2017, 5:12 a.m. UTC 
The > should be >= or we read one space beyond the end of the array.

Fixes: ab5c4f71d8c7 ("ath9k: allow to load EEPROM content via firmware API")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Kalle Valo April 19, 2017, 1:58 p.m. UTC | #1 
Dan Carpenter <dan.carpenter@oracle.com> wrote:
> The > should be >= or we read one space beyond the end of the array.
> 
> Fixes: ab5c4f71d8c7 ("ath9k: allow to load EEPROM content via firmware API")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
> index fb80ec86e53d..6ccf24814514 100644
> --- a/drivers/net/wireless/ath/ath9k/eeprom.c
> +++ b/drivers/net/wireless/ath/ath9k/eeprom.c
> @@ -112,7 +112,7 @@ void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,
>  static bool ath9k_hw_nvram_read_array(u16 *blob, size_t blob_size,
>  				      off_t offset, u16 *data)
>  {
> -	if (offset > blob_size)
> +	if (offset >= blob_size)
>  		return false;
>  
>  	*data =  blob[offset];

Patch applied to ath-next branch of ath.git, thanks.

b7dcf68f383a ath9k: off by one in ath9k_hw_nvram_read_array()
diff mbox

Patch

diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index fb80ec86e53d..6ccf24814514 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -112,7 +112,7 @@  void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,
 static bool ath9k_hw_nvram_read_array(u16 *blob, size_t blob_size,
 				      off_t offset, u16 *data)
 {
-	if (offset > blob_size)
+	if (offset >= blob_size)
 		return false;
 
 	*data =  blob[offset];