raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 01:49:46 +00:00
Code Issues Projects Releases Wiki Activity

wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()

Browse Source 
There some bounds checking to ensure that "map_addr" is not out of
bounds before the start of the loop.  But the checking needs to be
done as we iterate through the loop because "map_addr" gets larger as
we iterate.

Fixes: 26f1fad29a ("New driver: rtl8xxxu (mac80211)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jes Sorensen <Jes.Sorensen@gmail.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/Yv8eGLdBslLAk3Ct@kili
This commit is contained in:
Dan Carpenter
2022-08-19 08:22:32 +03:00
committed by Kalle Valo
parent fec11dee17
commit 620d5eaeb9
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
View File

@@ -1878,13 +1878,6 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv)
/* We have 8 bits to indicate validity */
map_addr = offset * 8;
if (map_addr >= EFUSE_MAP_LEN) {
dev_warn(dev, "%s: Illegal map_addr (%04x), "
"efuse corrupt!\n",
__func__, map_addr);
ret = -EINVAL;
goto exit;
}
for (i = 0; i < EFUSE_MAX_WORD_UNIT; i++) {
/* Check word enable condition in the section */
if (word_mask & BIT(i)) {
@@ -1895,6 +1888,13 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv)
ret = rtl8xxxu_read_efuse8(priv, efuse_addr++, &val8);
if (ret)
goto exit;
if (map_addr >= EFUSE_MAP_LEN - 1) {
dev_warn(dev, "%s: Illegal map_addr (%04x), "
"efuse corrupt!\n",
__func__, map_addr);
ret = -EINVAL;
goto exit;
}
priv->efuse_wifi.raw[map_addr++] = val8;
ret = rtl8xxxu_read_efuse8(priv, efuse_addr++, &val8);