From: Dan Carpenter <dan.carpenter@oracle.com>
To: Arend van Spriel <aspriel@gmail.com>,
Matthias Brugger <mbrugger@suse.com>
Cc: Franky Lin <franky.lin@broadcom.com>,
Hante Meuleman <hante.meuleman@broadcom.com>,
Chi-hsien Lin <chi-hsien.lin@infineon.com>,
Wright Feng <wright.feng@infineon.com>,
Chung-hsien Hsu <chung-hsien.hsu@infineon.com>,
Kalle Valo <kvalo@codeaurora.org>,
Hans deGoede <hdegoede@redhat.com>,
linux-wireless@vger.kernel.org,
brcm80211-dev-list.pdl@broadcom.com,
kernel-janitors@vger.kernel.org
Subject: [PATCH] brcmfmac: fix a loop exit condition
Date: Fri, 23 Apr 2021 14:46:34 +0300 [thread overview]
Message-ID: <YIKzmoMiTdToaIyP@mwanda> (raw)
This code is supposed to loop over the whole board_type[] string. The
current code kind of works just because ascii values start 97 and the
string is likely shorter than that so it will break when we hit the NUL
terminator. But really the condition should be "i < len" instead of
"i < board_type[i]".
Fixes: 29e354ebeeec ("brcmfmac: Transform compatible string for FW loading")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
index a7554265f95f..9b75e396fc50 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
@@ -34,7 +34,7 @@ void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
len = strlen(tmp) + 1;
board_type = devm_kzalloc(dev, len, GFP_KERNEL);
strscpy(board_type, tmp, len);
- for (i = 0; i < board_type[i]; i++) {
+ for (i = 0; i < len; i++) {
if (board_type[i] == '/')
board_type[i] = '-';
}
--
2.30.2
next reply other threads:[~2021-04-23 11:46 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-23 11:46 Dan Carpenter [this message]
2021-04-23 11:56 ` [PATCH] brcmfmac: fix a loop exit condition Matthias Brugger
2021-04-23 11:59 ` Johannes Berg
2021-04-23 12:11 ` Dan Carpenter
2021-04-23 12:20 ` Christophe JAILLET
2021-04-23 12:54 ` Johannes Berg
2021-05-08 11:02 ` Dan Carpenter
2021-06-15 10:26 ` Kalle Valo
[not found] ` <20210615102656.DBB04C43143@smtp.codeaurora.org>
2021-06-15 12:52 ` Dan Carpenter
2021-06-15 13:45 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YIKzmoMiTdToaIyP@mwanda \
--to=dan.carpenter@oracle.com \
--cc=aspriel@gmail.com \
--cc=brcm80211-dev-list.pdl@broadcom.com \
--cc=chi-hsien.lin@infineon.com \
--cc=chung-hsien.hsu@infineon.com \
--cc=franky.lin@broadcom.com \
--cc=hante.meuleman@broadcom.com \
--cc=hdegoede@redhat.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=kvalo@codeaurora.org \
--cc=linux-wireless@vger.kernel.org \
--cc=mbrugger@suse.com \
--cc=wright.feng@infineon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).