* [PATCH][next] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
@ 2020-01-26 0:09 Colin King
2020-01-26 9:39 ` Stanislaw Gruszka
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Colin King @ 2020-01-26 0:09 UTC (permalink / raw)
To: Stanislaw Gruszka, Kalle Valo, David S . Miller,
Meenakshi Venkataraman, Wey-Yi Guy, Johannes Berg,
linux-wireless, netdev
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
The loop counter addr is a u16 where as the upper limit of the loop
is a an int. In the unlikely event that the il->cfg->eeprom_size is
greater than 64K then we end up with an infinite loop since addr will
wrap around an never reach upper loop limit. Fix this by making addr
an int.
Addresses-Coverity: ("Infinite loop")
Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/net/wireless/intel/iwlegacy/common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
index d966b29b45ee..348c17ce72f5 100644
--- a/drivers/net/wireless/intel/iwlegacy/common.c
+++ b/drivers/net/wireless/intel/iwlegacy/common.c
@@ -699,7 +699,7 @@ il_eeprom_init(struct il_priv *il)
u32 gp = _il_rd(il, CSR_EEPROM_GP);
int sz;
int ret;
- u16 addr;
+ int addr;
/* allocate eeprom */
sz = il->cfg->eeprom_size;
--
2.24.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH][next] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
2020-01-26 0:09 [PATCH][next] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop Colin King
@ 2020-01-26 9:39 ` Stanislaw Gruszka
2020-01-26 10:04 ` Sergei Shtylyov
2020-01-26 15:52 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Stanislaw Gruszka @ 2020-01-26 9:39 UTC (permalink / raw)
To: Colin King
Cc: Kalle Valo, David S . Miller, Meenakshi Venkataraman, Wey-Yi Guy,
Johannes Berg, linux-wireless, netdev, kernel-janitors,
linux-kernel
On Sun, Jan 26, 2020 at 12:09:54AM +0000, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The loop counter addr is a u16 where as the upper limit of the loop
> is a an int. In the unlikely event that the il->cfg->eeprom_size is
> greater than 64K then we end up with an infinite loop since addr will
> wrap around an never reach upper loop limit. Fix this by making addr
> an int.
>
> Addresses-Coverity: ("Infinite loop")
> Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH][next] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
2020-01-26 0:09 [PATCH][next] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop Colin King
2020-01-26 9:39 ` Stanislaw Gruszka
@ 2020-01-26 10:04 ` Sergei Shtylyov
2020-01-26 15:52 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Sergei Shtylyov @ 2020-01-26 10:04 UTC (permalink / raw)
To: Colin King, Stanislaw Gruszka, Kalle Valo, David S . Miller,
Meenakshi Venkataraman, Wey-Yi Guy, Johannes Berg,
linux-wireless, netdev
Cc: kernel-janitors, linux-kernel
Hello!
On 26.01.2020 3:09, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The loop counter addr is a u16 where as the upper limit of the loop
> is a an int. In the unlikely event that the il->cfg->eeprom_size is
^^^^
Double article? :-)
> greater than 64K then we end up with an infinite loop since addr will
> wrap around an never reach upper loop limit. Fix this by making addr
> an int.
>
> Addresses-Coverity: ("Infinite loop")
> Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
[...]
MBR< Sergei
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH][next] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
2020-01-26 0:09 [PATCH][next] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop Colin King
2020-01-26 9:39 ` Stanislaw Gruszka
2020-01-26 10:04 ` Sergei Shtylyov
@ 2020-01-26 15:52 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2020-01-26 15:52 UTC (permalink / raw)
To: Colin King
Cc: Stanislaw Gruszka, David S . Miller, Meenakshi Venkataraman,
Wey-Yi Guy, Johannes Berg, linux-wireless, netdev,
kernel-janitors, linux-kernel
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The loop counter addr is a u16 where as the upper limit of the loop
> is an int. In the unlikely event that the il->cfg->eeprom_size is
> greater than 64K then we end up with an infinite loop since addr will
> wrap around an never reach upper loop limit. Fix this by making addr
> an int.
>
> Addresses-Coverity: ("Infinite loop")
> Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Patch applied to wireless-drivers-next.git, thanks.
c2f9a4e4a5ab iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
--
https://patchwork.kernel.org/patch/11351769/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-01-26 15:52 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-26 0:09 [PATCH][next] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop Colin King
2020-01-26 9:39 ` Stanislaw Gruszka
2020-01-26 10:04 ` Sergei Shtylyov
2020-01-26 15:52 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).