ath9k: off by one in ath9k_hw_nvram_read_array()
Subsystems (2)
PATCH 1/1 ath9k: off by one in ath9k_hw_nvram_read_array()
The > should be >= or we read one space beyond the end of the array.
Fixes ab5c4f71d8c7 ("ath9k: allow to load EEPROM content via firmware API")
Signed-off-by Dan Carpenter <[email protected]>
drivers/net/wireless/ath/ath9k/eeprom.c +1 -1
@@ -112,7 +112,7 @@ void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,static bool ath9k_hw_nvram_read_array (u16 *blob,size_t blob_size,off_t offset,u16 *data) { -if (offset > blob_size) +if (offset >= blob_size)return false; *data = blob[offset];
Quoted 10 lines · Dan Carpenter
The > should be >= or we read one space beyond the end of the array.
Fixes ab5c4f71d8c7 ("ath9k: allow to load EEPROM content via firmware API")Signed-off-by Dan Carpenter <[email protected]>drivers/net/wireless/ath/ath9k/eeprom.c +0
-0
drivers/net/wireless/ath/ath9k/eeprom.c void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data, · line 118
Quoted 8 lines
drivers/net/wireless/ath/ath9k/eeprom.c +1
-1@@ -112,7 +112,7 @@ void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data,static bool ath9k_hw_nvram_read_array (u16 *blob,size_t blob_size,off_t offset,u16 *data) { -if (offset > blob_size) +if (offset >= blob_size)return false; *data = blob[offset];
Patch applied to ath-next branch of ath.git, thanks.
b7dcf68f383a ath9k: off by one in ath9k_hw_nvram_read_array()
Signature · 3 lines
https://patchwork.kernel.org/patch/9666031/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches