]> www.infradead.org Git - users/jedix/linux-maple.git/commit
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
authorRand Deeb <rand.sec96@gmail.com>
Wed, 13 Mar 2024 10:17:55 +0000 (13:17 +0300)
committerMiri Korenblit <miriam.rachel.korenblit@intel.com>
Wed, 25 Jun 2025 07:57:34 +0000 (10:57 +0300)
commite3ad987e9dc7d1e12e3f2f1e623f0e174cd0ca78
tree497b5deafcfefcb3300a1f294419fed9612f0521
parent90a0d9f339960448a3acc1437a46730f975efd6a
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()

The 'index' variable in the rs_fill_link_cmd() function can reach
LINK_QUAL_MAX_RETRY_NUM during the execution of the inner loop. This
variable is used as an index for the lq_cmd->rs_table array, which has a
size of LINK_QUAL_MAX_RETRY_NUM, without proper validation.

Modify the condition of the inner loop to ensure that the 'index' variable
does not exceed LINK_QUAL_MAX_RETRY_NUM - 1, thereby preventing any
potential overflow issues.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Rand Deeb <rand.sec96@gmail.com>
Link: https://patch.msgid.link/20240313101755.269209-1-rand.sec96@gmail.com
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
drivers/net/wireless/intel/iwlwifi/dvm/rs.c