From: Deren Wu <Deren.Wu@mediatek.com>
To: Felix Fietkau <nbd@nbd.name>, Lorenzo Bianconi <lorenzo@kernel.org>
Cc: Sean Wang <sean.wang@mediatek.com>,
Soul Huang <Soul.Huang@mediatek.com>,
YN Chen <YN.Chen@mediatek.com>, Leon Yen <Leon.Yen@mediatek.com>,
Eric-SY Chang <Eric-SY.Chang@mediatek.com>,
Deren Wu <Deren.Wu@mediatek.com>, KM Lin <km.lin@mediatek.com>,
Robin Chiu <robin.chiu@mediatek.com>,
CH Yeh <ch.yeh@mediatek.com>, Posh Sun <posh.sun@mediatek.com>,
Stella Chang <Stella.Chang@mediatek.com>,
Evelyn Tsai <evelyn.tsai@mediatek.com>,
Ryder Lee <ryder.lee@mediatek.com>,
Shayne Chen <shayne.chen@mediatek.com>,
linux-wireless <linux-wireless@vger.kernel.org>,
linux-mediatek <linux-mediatek@lists.infradead.org>,
Deren Wu <deren.wu@mediatek.com>
Subject: [PATCH] wifi: mt76: fix coverity overrun-call in mt76_get_txpower()
Date: Sun, 27 Nov 2022 10:35:37 +0800 [thread overview]
Message-ID: <6a032457ec0e4b51e649e975fa6272ad78ce4985.1669516185.git.deren.wu@mediatek.com> (raw)
From: Deren Wu <deren.wu@mediatek.com>
Make sure the nss is valid for nss_delta array. Return zero
if the index is invalid.
Coverity message:
Event overrun-call: Overrunning callee's array of size 4 by passing
argument "n_chains" (which evaluates to 15) in call to
"mt76_tx_power_nss_delta".
int delta = mt76_tx_power_nss_delta(n_chains);
Fixes: 07cda406308b ("mt76: fix rounding issues on converting per-chain and combined txpower")
Signed-off-by: Deren Wu <deren.wu@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt76.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 33f87e518d68..32a77a0ae9da 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -1110,8 +1110,9 @@ static inline bool mt76_is_skb_pktid(u8 pktid)
static inline u8 mt76_tx_power_nss_delta(u8 nss)
{
static const u8 nss_delta[4] = { 0, 6, 9, 12 };
+ u8 idx = nss - 1;
- return nss_delta[nss - 1];
+ return (idx < ARRAY_SIZE(nss_delta)) ? nss_delta[idx] : 0;
}
static inline bool mt76_testmode_enabled(struct mt76_phy *phy)
--
2.18.0
reply other threads:[~2022-11-27 2:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a032457ec0e4b51e649e975fa6272ad78ce4985.1669516185.git.deren.wu@mediatek.com \
--to=deren.wu@mediatek.com \
--cc=Eric-SY.Chang@mediatek.com \
--cc=Leon.Yen@mediatek.com \
--cc=Soul.Huang@mediatek.com \
--cc=Stella.Chang@mediatek.com \
--cc=YN.Chen@mediatek.com \
--cc=ch.yeh@mediatek.com \
--cc=evelyn.tsai@mediatek.com \
--cc=km.lin@mediatek.com \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo@kernel.org \
--cc=nbd@nbd.name \
--cc=posh.sun@mediatek.com \
--cc=robin.chiu@mediatek.com \
--cc=ryder.lee@mediatek.com \
--cc=sean.wang@mediatek.com \
--cc=shayne.chen@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.