netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Colin Ian King <colin.king@canonical.com>,
	Stanislaw Gruszka <stf_xl@wp.pl>,
	Kalle Valo <kvalo@codeaurora.org>,
	Sasha Levin <sashal@kernel.org>,
	linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 122/141] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
Date: Fri, 14 Feb 2020 11:21:02 -0500	[thread overview]
Message-ID: <20200214162122.19794-122-sashal@kernel.org> (raw)
In-Reply-To: <20200214162122.19794-1-sashal@kernel.org>

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit c2f9a4e4a5abfc84c01b738496b3fd2d471e0b18 ]

The loop counter addr is a u16 where as the upper limit of the loop
is an int. In the unlikely event that the il->cfg->eeprom_size is
greater than 64K then we end up with an infinite loop since addr will
wrap around an never reach upper loop limit. Fix this by making addr
an int.

Addresses-Coverity: ("Infinite loop")
Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlegacy/common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
index 140b6ea8f7cc4..db2373fe8ac32 100644
--- a/drivers/net/wireless/intel/iwlegacy/common.c
+++ b/drivers/net/wireless/intel/iwlegacy/common.c
@@ -717,7 +717,7 @@ il_eeprom_init(struct il_priv *il)
 	u32 gp = _il_rd(il, CSR_EEPROM_GP);
 	int sz;
 	int ret;
-	u16 addr;
+	int addr;
 
 	/* allocate eeprom */
 	sz = il->cfg->eeprom_size;
-- 
2.20.1


  parent reply	other threads:[~2020-02-14 16:24 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20200214162122.19794-1-sashal@kernel.org>
2020-02-14 16:19 ` [PATCH AUTOSEL 4.9 006/141] brcmfmac: Fix use after free in brcmf_sdio_readframes() Sasha Levin
2020-02-14 16:19 ` [PATCH AUTOSEL 4.9 007/141] gianfar: Fix TX timestamping with a stacked DSA driver Sasha Levin
2020-02-14 16:19 ` [PATCH AUTOSEL 4.9 028/141] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held Sasha Levin
2020-02-14 16:19 ` [PATCH AUTOSEL 4.9 029/141] libertas: make lbs_ibss_join_existing() return error code on rates overflow Sasha Levin
2020-02-14 16:19 ` [PATCH AUTOSEL 4.9 049/141] net/wan/fsl_ucc_hdlc: reject muram offsets above 64K Sasha Levin
2020-02-14 16:19 ` [PATCH AUTOSEL 4.9 051/141] NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu() Sasha Levin
2020-02-14 16:19 ` [PATCH AUTOSEL 4.9 058/141] isdn: don't mark kcapi_proc_exit as __exit Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 061/141] b43legacy: Fix -Wcast-function-type Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 062/141] ipw2x00: " Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 063/141] iwlegacy: " Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 064/141] rtlwifi: rtl_pci: " Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 066/141] orinoco: avoid assertion in case of NULL pointer Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 072/141] net/wan/fsl_ucc_hdlc: remove set but not used variables 'ut_info' and 'ret' Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 079/141] tools lib api fs: Fix gcc9 stringop-truncation compilation error Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 089/141] wan: ixp4xx_hss: fix compile-testing on 64-bit Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 118/141] hostap: Adjust indentation in prism2_hostapd_add_sta Sasha Levin
2020-02-14 16:20 ` [PATCH AUTOSEL 4.9 119/141] rtlwifi: rtl8821ae: remove unused variables Sasha Levin
2020-02-14 16:21 ` [PATCH AUTOSEL 4.9 120/141] rtlwifi: rtl8192ee: " Sasha Levin
2020-02-14 16:21 ` [PATCH AUTOSEL 4.9 121/141] rtlwifi: rtl8723ae: " Sasha Levin
2020-02-14 16:21 ` Sasha Levin [this message]
2020-02-14 16:21 ` [PATCH AUTOSEL 4.9 124/141] mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() Sasha Levin
2020-02-14 16:21 ` [PATCH AUTOSEL 4.9 125/141] mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() Sasha Levin
2020-02-14 16:21 ` [PATCH AUTOSEL 4.9 137/141] iwlwifi: mvm: Fix thermal zone registration Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200214162122.19794-122-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=colin.king@canonical.com \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=stf_xl@wp.pl \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).