iwlwifi: out-of-bounds access in iwl_init_sband_channels

KASan error report:
==================================================================
BUG: KASan: out of bounds access in iwl_init_sband_channels+0x207/0x260 [iwlwifi] at addr ffff8800c2d0aac8
Read of size 4 by task modprobe/329
==================================================================

Both loops of this function compare data from the 'chan' array and then
check if the index is valid.

The 2 conditions should be inverted to avoid an out-of-bounds access.

Signed-off-by: Adrien Schildknecht <adrien+dev@schischi.me>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
index 21302b6f2bfd79a8e8617a345e3771f6608c0145..acc3d186c5c101b0834fb4e424fe2203a66bb2d0 100644 (file)
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
@@ -713,12 +713,12 @@ int iwl_init_sband_channels(struct iwl_nvm_data *data,
        struct ieee80211_channel *chan = &data->channels[0];
        int n = 0, idx = 0;
 
-       while (chan->band != band && idx < n_channels)
+       while (idx < n_channels && chan->band != band)
                chan = &data->channels[++idx];
 
        sband->channels = &data->channels[idx];
 
-       while (chan->band == band && idx < n_channels) {
+       while (idx < n_channels && chan->band == band) {
                chan = &data->channels[++idx];
                n++;
        }