Skip to contentSkip to conversation

wifi: mt7601u: fix possible index-out-of-bound in mt76_init_sband_2g()

PATCH NAK Dmitry Kandybka 2 participants 2 messages Apr 22, 2025

Subsystems (2)
Arm MediaTek MediaTek MT7601U wireless LAN driver
lore
Share & tools
lore

Dmitry Kandybka

author
#0 lore raw

PATCH 1/1 wifi: mt7601u: fix possible index-out-of-bound in mt76_init_sband_2g()

In 'mt76_init_sband_2g', add return with '-EINVAL' in case of register channel start bound exceeds size of 'mt76_channels_2ghz' array. Compile tested only.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by Dmitry Kandybka <[email protected]>
---
 drivers/net/wireless/mediatek/mt7601u/init.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt7601u/init.c +3 -2
index 5d9e952b2966..d2e0f2af4f79 100644
@@ -562,8 +562,9 @@ mt76_init_sband_2g(struct mt7601u_dev *dev)
 
 	dev->hw->wiphy->bands[NL80211_BAND_2GHZ] = dev->sband_2g;
 
-	WARN_ON(dev->ee->reg.start - 1 + dev->ee->reg.num >
-		ARRAY_SIZE(mt76_channels_2ghz));
+	if (WARN_ON(dev->ee->reg.start - 1 + dev->ee->reg.num >
+		ARRAY_SIZE(mt76_channels_2ghz)))
+		return -EINVAL;
 
 	return mt76_init_sband(dev, dev->sband_2g,
 			       &mt76_channels_2ghz[dev->ee->reg.start - 1],
Signature · 1 line
2.43.5
maintainer NAK
#1 lore raw
Quoted 3 lines · On Tue, 22 Apr 2025 14:07:26 +0300 Dmitry Kandybka wrote:

In 'mt76_init_sband_2g', add return with '-EINVAL' in case of register channel start bound exceeds size of 'mt76_channels_2ghz' array. Compile tested only.

nack, please try to find real issue instead of wasting people's time