Skip to contentSkip to conversation

iwlwifi: silence buffer overflow warning

PATCH In review Dan Carpenter 2 participants 2 messages Jan 9, 2010 – Jan 11, 2010 Networking drivers (wireless)

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 iwlwifi: silence buffer overflow warning

Smatch (and presumably other static checkers) complain that MAX_TID_COUNT is past the end of the array. In the resulting discussion, Zhu Yi pointed out that this value is not used in real life and the assignment was only there to silence a gcc warning.

If there were a bug in the surrounding code and the value were used, the WARN_ON(!qc) would print a warning before the crash.

drivers/net/wireless/iwlwifi/iwl-4965.c +1 -1
@@ -1961,7 +1961,7 @@ static void iwl4965_rx_reply_tx(struct i
 	struct ieee80211_tx_info *info;
 	struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
 	u32  status = le32_to_cpu(tx_resp->u.status);
-	int tid = MAX_TID_COUNT;
+	int uninitialized_var(tid);
 	int sta_id;
 	int freed;
 	u8 *qc = NULL;
Acked-by on v1 1/1
#1 lore raw
Quoted 9 lines · Dan Carpenter

Smatch (and presumably other static checkers) complain that MAX_TID_COUNT is past the end of the array. In the resulting discussion, Zhu Yi pointed out that this value is not used in real life and the assignment was only there to silence a gcc warning.

If there were a bug in the surrounding code and the value were used, the WARN_ON(!qc) would print a warning before the crash.

Thanks,
-yi

Quoted 11 lines
drivers/net/wireless/iwlwifi/iwl-4965.c +1 -1
@@ -1961,7 +1961,7 @@ static void iwl4965_rx_reply_tx(struct i
 	struct ieee80211_tx_info *info;
 	struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
 	u32  status = le32_to_cpu(tx_resp->u.status);
-	int tid = MAX_TID_COUNT;
+	int uninitialized_var(tid);
 	int sta_id;
 	int freed;
 	u8 *qc = NULL;