Luca Coelho 0c38cad1d1 iwlwifi: mvm: check return value of rs_rate_from_ucode_rate() ...

commit 3d71c3f1f5 upstream.

The rs_rate_from_ucode_rate() function may return -EINVAL if the rate
is invalid, but none of the callsites check for the error, potentially
making us access arrays with index IWL_RATE_INVALID, which is larger
than the arrays, causing an out-of-bounds access.  This will trigger
KASAN warnings, such as the one reported in the bugzilla issue
mentioned below.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=200659

Cc: stable@vger.kernel.org
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-11-13 11:15:04 -08:00

..

admtek

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ath

ath10k: schedule hardware restart if WMI command times out

2018-11-13 11:14:56 -08:00

atmel

at76c50x: constify usb_device_id

2017-08-10 11:55:57 +03:00

broadcom

brcmfmac: fix for proper support of 160MHz bandwidth

2018-11-13 11:14:55 -08:00

cisco

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

intel

iwlwifi: mvm: check return value of rs_rate_from_ucode_rate()

2018-11-13 11:15:04 -08:00

intersil

p54: don't unregister leds when they are not initialized

2017-11-30 08:40:52 +00:00

marvell

libertas: don't set URB_ZERO_PACKET on IN USB transfer

2018-11-13 11:15:02 -08:00

mediatek

mt7601u: check memory allocation failure

2017-08-24 12:54:33 +03:00

quantenna

qtnfmac: modify full Tx queue error reporting

2017-12-20 10:10:30 +01:00

ralink

Revert "rt2800: use TXOP_BACKOFF for probe frames"

2018-06-05 11:41:59 +02:00

realtek

rtlwifi: rtl8821ae: fix firmware is not ready to run

2018-07-22 14:28:48 +02:00

rsi

rsi: fix nommu_map_sg overflow kernel panic

2018-08-03 07:50:39 +02:00

st

mac80211: use QoS NDP for AP probing

2018-02-03 17:39:03 +01:00

ti

wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()

2018-10-03 17:00:52 -07:00

zydas

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

qtnfmac: introduce new FullMAC driver for Quantenna chipsets

2017-05-24 17:04:13 +03:00

mac80211_hwsim.c

mac80211_hwsim: do not omit multicast announce of first added radio

2018-11-04 14:52:38 +01:00

mac80211_hwsim.h

mac80211_hwsim: fix command documentation indentation

2017-03-06 09:21:48 +01:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ray_cs.c

ray_cs: Avoid reading past end of buffer

2017-05-22 18:27:22 +03:00

ray_cs.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

rayctl.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

rndis_wlan.c

rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication()

2018-10-03 17:00:52 -07:00

wl3501_cs.c

wl3501_cs: fix spelling mistake: "Insupported" -> "Unsupported"

2017-07-28 18:06:31 +03:00

wl3501.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00