mt76: mt7915: potential array overflow in mt7915_mcu_tx_rate_report()

Browse source

Smatch complains that "wcidx" value comes from the network and thus
cannot be trusted.  In this case, it actually seems to come from the
firmware.  If your wireless firmware is malicious then probably no
amount of carefulness can protect you.

On the other hand, these days we still try to check the firmware as much
as possible.  Verifying that the index is within bounds will silence a
static checker warning.  And it's harmless and a good exercise in kernel
hardening.  So I suggest that we do add a bounds check.

Fixes: e57b790146 ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>

...

This commit is contained in:

Dan Carpenter 2020-07-09 14:04:35 +03:00 • committed by Felix Fietkau

parent 9248c08c3f

commit eb744e5df8

1 changed files with 13 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

19

drivers/net/wireless/mediatek/mt76/mt7915/mcu.c

View file