Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 12 Apr 2017 07:21:55 +0000 (UTC)
From:      Andriy Voskoboinyk <avos@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r316723 - in head/sys/dev/rtwn: rtl8188e rtl8192c rtl8812a
Message-ID:  <201704120721.v3C7LtcR098194@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: avos
Date: Wed Apr 12 07:21:54 2017
New Revision: 316723
URL: https://svnweb.freebsd.org/changeset/base/316723

Log:
  rtwn: remove out-of-bounds access + fix debug output.
  
  Omit unused rates while initializing / dumping Tx power values.
  
  They were not accessed anywhere (except for debugging), so this is
  (mostly) no-op.
  
  Tested with
   * RTL8188EU, STA mode.
   * RTL8812AU, STA mode.
  
  Found by:	PVS-Studio

Modified:
  head/sys/dev/rtwn/rtl8188e/r88e_chan.c
  head/sys/dev/rtwn/rtl8192c/r92c_chan.c
  head/sys/dev/rtwn/rtl8812a/r12a_chan.c

Modified: head/sys/dev/rtwn/rtl8188e/r88e_chan.c
==============================================================================
--- head/sys/dev/rtwn/rtl8188e/r88e_chan.c	Wed Apr 12 06:24:35 2017	(r316722)
+++ head/sys/dev/rtwn/rtl8188e/r88e_chan.c	Wed Apr 12 07:21:54 2017	(r316723)
@@ -110,7 +110,7 @@ r88e_get_txpower(struct rtwn_softc *sc, 
 		for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++)
 			power[ridx] = base->pwr[0][ridx];
 	}
-	for (ridx = RTWN_RIDX_OFDM6; ridx < RTWN_RIDX_COUNT; ridx++) {
+	for (ridx = RTWN_RIDX_OFDM6; ridx <= max_mcs; ridx++) {
 		if (rs->regulatory == 3)
 			power[ridx] = base->pwr[0][ridx];
 		else if (rs->regulatory == 1) {

Modified: head/sys/dev/rtwn/rtl8192c/r92c_chan.c
==============================================================================
--- head/sys/dev/rtwn/rtl8192c/r92c_chan.c	Wed Apr 12 06:24:35 2017	(r316722)
+++ head/sys/dev/rtwn/rtl8192c/r92c_chan.c	Wed Apr 12 07:21:54 2017	(r316723)
@@ -229,13 +229,13 @@ r92c_set_txpower(struct rtwn_softc *sc, 
 		rtwn_r92c_get_txpower(sc, i, c, power);
 #ifdef RTWN_DEBUG
 		if (sc->sc_debug & RTWN_DEBUG_TXPWR) {
-			int ridx;
+			int max_mcs, ridx;
+
+			max_mcs = RTWN_RIDX_MCS(sc->ntxchains * 8 - 1);
 
 			/* Dump per-rate Tx power values. */
 			printf("Tx power for chain %d:\n", i);
-			for (ridx = RTWN_RIDX_CCK1;
-			     ridx < RTWN_RIDX_COUNT;
-			     ridx++)
+			for (ridx = RTWN_RIDX_CCK1; ridx <= max_mcs; ridx++)
 				printf("Rate %d = %u\n", ridx, power[ridx]);
 		}
 #endif

Modified: head/sys/dev/rtwn/rtl8812a/r12a_chan.c
==============================================================================
--- head/sys/dev/rtwn/rtl8812a/r12a_chan.c	Wed Apr 12 06:24:35 2017	(r316722)
+++ head/sys/dev/rtwn/rtl8812a/r12a_chan.c	Wed Apr 12 07:21:54 2017	(r316723)
@@ -247,7 +247,7 @@ r12a_get_txpower(struct rtwn_softc *sc, 
 	if (sc->sc_debug & RTWN_DEBUG_TXPWR) {
 		/* Dump per-rate Tx power values. */
 		printf("Tx power for chain %d:\n", chain);
-		for (ridx = RTWN_RIDX_CCK1; ridx < RTWN_RIDX_COUNT; ridx++)
+		for (ridx = RTWN_RIDX_CCK1; ridx <= max_mcs; ridx++)
 			printf("Rate %d = %u\n", ridx, power[ridx]);
 	}
 #endif

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201704120721.v3C7LtcR098194>