ath6kl: add an extra band check to ath6kl_wmi_beginscan_cmd()
authorKalle Valo <kvalo@qca.qualcomm.com>
Sun, 10 Mar 2013 05:51:29 +0000 (07:51 +0200)
committerKalle Valo <kvalo@qca.qualcomm.com>
Mon, 18 Mar 2013 11:50:19 +0000 (13:50 +0200)
Dan reported that smatch found a possible issue in ath6kl_wmi_beginscan_cmd()
where we might access sc->supp_rates beyond the end. It shouldn't happen as
ar->wiphy->bands always have just the first two bands set, but add an extra
check just to be sure.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
drivers/net/wireless/ath/ath6kl/wmi.c

index 31a308103f4c4c00fcfab0057d85769ba464958e..87aefb4c4c23c5d8355df9e3c30ba08a6855278e 100644 (file)
@@ -2029,6 +2029,9 @@ int ath6kl_wmi_beginscan_cmd(struct wmi *wmi, u8 if_idx,
                if (!sband)
                        continue;
 
+               if (WARN_ON(band >= ATH6KL_NUM_BANDS))
+                       break;
+
                ratemask = rates[band];
                supp_rates = sc->supp_rates[band].rates;
                num_rates = 0;