| Message ID | 20250424183338.3277-1-a.safin@rosa.ru |
|---|---|
| State | New |
| Headers | show |
| Series | iwlegacy: 4965: fix possible out-of-bounds access in il4965_tx_cmd_build_rate() | expand |
diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c index 78dee8ccfebf..f60d9b9798c1 100644 --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c @@ -1572,7 +1572,7 @@ il4965_tx_cmd_build_rate(struct il_priv *il, */ rate_idx = info->control.rates[0].idx; if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0 - || rate_idx > RATE_COUNT_LEGACY) + || rate_idx >= RATE_COUNT_LEGACY) rate_idx = rate_lowest_index(&il->bands[info->band], sta); /* For 5 GHZ band, remap mac80211 rate indices into driver indices */ if (info->band == NL80211_BAND_5GHZ)
Prevent out-of-bounds access in il4965_tx_cmd_build_rate() by rejecting rate_idx values greater than or equal to RATE_COUNT_LEGACY. Use a correct bounds check to avoid accessing il_rates[] with an invalid index. The previous comparison allowed rate_idx to become equal to RATE_COUNT_LEGACY, which exceeds the array limit. Replace the check 'rate_idx > RATE_COUNT_LEGACY' with 'rate_idx >= RATE_COUNT_LEGACY' to ensure memory safety. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7ac9a364c172 ("iwlegacy: move under intel directory") Signed-off-by: Alexei Safin <a.safin@rosa.ru> --- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)