linux-kernel - [PATCH 4/4] ath: Fix ath_dbg access beyond array bound

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu,  2 Dec 2010 19:12:38 -0800
From:	Joe Perches <joe@...ches.com>
To:	"Luis R. Rodriguez" <lrodriguez@...eros.com>,
	Jouni Malinen <jmalinen@...eros.com>,
	Vasanthakumar Thiagarajan <vasanth@...eros.com>,
	Senthil Balasubramanian <senthilkumar@...eros.com>
Cc:	Peter Stuge <peter@...ge.se>, Felix Fietkau <nbd@...nwrt.org>,
	"John W. Linville" <linville@...driver.com>,
	linux-wireless@...r.kernel.org, ath9k-devel@...ts.ath9k.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 4/4] ath: Fix ath_dbg access beyond array bound

ar9300RateSize is not necessarily a power of 4.

Change ar9003_hw_set_target_power_eeprom
to print the targetPowerValT2 array one per line.

ath9k_hw_ar9300_set_txpower repeated the output 4 times per line,
change it to print the targetPowerValT2 value one per line.

Signed-off-by: Joe Perches <joe@...ches.com>
---
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c |   27 +----------------------
 1 files changed, 2 insertions(+), 25 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 7b13a2e..34d1d7a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -4086,22 +4086,9 @@ static void ar9003_hw_set_target_power_eeprom(struct ath_hw *ah, u16 freq,
 	    ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_23, freq,
 					      is2GHz) + ht40PowerIncForPdadc;
 
-	while (i < ar9300RateSize) {
-		ath_dbg(common, ATH_DBG_EEPROM,
-			"TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
-		i++;
-
-		ath_dbg(common, ATH_DBG_EEPROM,
-			"TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
-		i++;
-
-		ath_dbg(common, ATH_DBG_EEPROM,
-			"TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
-		i++;
-
+	for (i = 0; i < ar9300RateSize; i++) {
 		ath_dbg(common, ATH_DBG_EEPROM,
 			"TPC[%02d] 0x%08x\n", i, targetPowerValT2[i]);
-		i++;
 	}
 }
 
@@ -4689,17 +4676,7 @@ static void ath9k_hw_ar9300_set_txpower(struct ath_hw *ah,
 
 	for (i = 0; i < ar9300RateSize; i++) {
 		ath_dbg(common, ATH_DBG_EEPROM,
-			"TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
-		i++;
-		ath_dbg(common, ATH_DBG_EEPROM,
-			"TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
-		i++;
-		ath_dbg(common, ATH_DBG_EEPROM,
-			"TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
-		i++;
-		ath_dbg(common, ATH_DBG_EEPROM,
-			"TPC[%02d] 0x%08x\n\n", i, targetPowerValT2[i]);
-		i++;
+			"TPC[%02d] 0x%08x\n", i, targetPowerValT2[i]);
 	}
 
 	/*
-- 
1.7.3.2.245.g03276.dirty

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/