Unverified Commit 9be0c95e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10698 wifi: mac80211: Avoid address calculations via out of bounds array indexing 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/2X7WUKD5XGVALPLTFNYVAU346DC4L56S/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAGEKT 
 
Link:https://gitee.com/openeuler/kernel/pulls/10698

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 51d0d913 4cbb9a66

net/mac80211/scan.c

+9 −8
Original line number Diff line number Diff line
@@ -346,7 +346,8 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) 
	struct cfg80211_scan_request *req;

	struct cfg80211_chan_def chandef;

	u8 bands_used = 0;

	int i, ielen, n_chans;

	int i, ielen;

	u32 *n_chans;

	u32 flags = 0;



	req = rcu_dereference_protected(local->scan_req,
@@ -356,34 +357,34 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) 
		return false;



	if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {

		local->hw_scan_req->req.n_channels = req->n_channels;



		for (i = 0; i < req->n_channels; i++) {

			local->hw_scan_req->req.channels[i] = req->channels[i];

			bands_used |= BIT(req->channels[i]->band);

		}



		n_chans = req->n_channels;

	} else {

		do {

			if (local->hw_scan_band == NUM_NL80211_BANDS)

				return false;



			n_chans = 0;

			n_chans = &local->hw_scan_req->req.n_channels;

			*n_chans = 0;



			for (i = 0; i < req->n_channels; i++) {

				if (req->channels[i]->band !=

				    local->hw_scan_band)

					continue;

				local->hw_scan_req->req.channels[n_chans] =

				local->hw_scan_req->req.channels[(*n_chans)++] =

							req->channels[i];

				n_chans++;



				bands_used |= BIT(req->channels[i]->band);

			}



			local->hw_scan_band++;

		} while (!n_chans);

		} while (!*n_chans);

	}



	local->hw_scan_req->req.n_channels = n_chans;

	ieee80211_prepare_scan_chandef(&chandef, req->scan_width);



	if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)