Skip to contentSkip to conversation

orinoco: Fix walking past the end of the buffer

PATCH In review Denis Kirjanov 2 participants 2 messages Aug 11, 2010 – Aug 14, 2010

Subsystems (3)
Networking Network drivers Networking drivers (wireless)
lore
Share & tools
lore

Denis Kirjanov

author
#0 lore raw

PATCH 1/1 orinoco: Fix walking past the end of the buffer

Fix walking past the end of the bitrate_table array
in the case when the loop counter == BITRATE_TABLE_SIZE. Mark bitrate as invalid in this case for the orinoco_ioctl_setrate()

Signed-off-by Denis Kirjanov <[email protected]>

---

drivers/net/wireless/orinoco/hw.c +4 -1
index 077baa8..191bc03 100644
@@ -765,9 +765,12 @@ int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate)
 			if (bitrate_table[i].intersil_txratectrl == val)
 				break;
 
-		if (i >= BITRATE_TABLE_SIZE)
+		if (i >= BITRATE_TABLE_SIZE) {
 			printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n",
 			       priv->ndev->name, val);
+			*bitrate = 100001; /* Mark as invalid */
+			break;
+		}
 
 		*bitrate = bitrate_table[i].bitrate * 100000;
 		break;

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

#1 lore raw

drivers/net/wireless/orinoco/hw.c int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate) · line 771

Quoted 13 lines · Denis Kirjanov
drivers/net/wireless/orinoco/hw.c +2 -1
index 077baa8..191bc03 100644
@@ -765,9 +765,12 @@ int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate)
                        if (bitrate_table[i].intersil_txratectrl == val)
                                break;
 
-               if (i >= BITRATE_TABLE_SIZE)
+               if (i >= BITRATE_TABLE_SIZE) {
                        printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n",
                               priv->ndev->name, val);
+                       *bitrate = 100001; /* Mark as invalid */

We should propogate the failure by returning an error in the return code rather than a cryptic bitrate value. The calling function(s) should then propogate the error through wext/cfg80211 as appropriate.

drivers/net/wireless/orinoco/hw.c int orinoco_hw_get_act_bitrate(struct orinoco_private *priv, int *bitrate) · line 776

Quoted 5 lines
drivers/net/wireless/orinoco/hw.c +2 -0
+                       break;
+               }
 
                *bitrate = bitrate_table[i].bitrate * 100000;
                break;

We can also make the structure easier to understand by setting the bitrate within the for loop. Something like the following (I only have access to gmail ATM, so can't format a proper patch):

		for (i = 0; i < BITRATE_TABLE_SIZE; i++)
			if (bitrate_table[i].intersil_txratectrl == val) {
				*bitrate = bitrate_table[i].bitrate * 100000;
				break;
			}

		if (i >= BITRATE_TABLE_SIZE) {
			printk(KERN_INFO "%s: Unable to determine current bitrate (0x%04hx)\n",
			       priv->ndev->name, val);
			err = -EIO; /* maybe chose a better value... */
		}

		break;

Could you update the patch along those lines please?

Thanks,

Dave.