Author: avos
Date: Wed Apr 12 07:21:54 2017
New Revision: 316723
URL: https://svnweb.freebsd.org/changeset/base/316723
Log:
rtwn: remove out-of-bounds access + fix debug output.
Omit unused rates while initializing / dumping Tx power values.
They were not accessed anywhere (except for debugging), so this is
(mostly) no-op.
Tested with
* RTL8188EU, STA mode.
* RTL8812AU, STA mode.
Found by: PVS-Studio
Modified:
head/sys/dev/rtwn/rtl8188e/r88e_chan.c
head/sys/dev/rtwn/rtl8192c/r92c_chan.c
head/sys/dev/rtwn/rtl8812a/r12a_chan.c
Modified: head/sys/dev/rtwn/rtl8188e/r88e_chan.c
==============================================================================
--- head/sys/dev/rtwn/rtl8188e/r88e_chan.c Wed Apr 12 06:24:35 2017
(r316722)
+++ head/sys/dev/rtwn/rtl8188e/r88e_chan.c Wed Apr 12 07:21:54 2017
(r316723)
@@ -110,7 +110,7 @@ r88e_get_txpower(struct rtwn_softc *sc,
for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++)
power[ridx] = base->pwr[0][ridx];
}
- for (ridx = RTWN_RIDX_OFDM6; ridx < RTWN_RIDX_COUNT; ridx++) {
+ for (ridx = RTWN_RIDX_OFDM6; ridx <= max_mcs; ridx++) {
if (rs->regulatory == 3)
power[ridx] = base->pwr[0][ridx];
else if (rs->regulatory == 1) {
Modified: head/sys/dev/rtwn/rtl8192c/r92c_chan.c
==============================================================================
--- head/sys/dev/rtwn/rtl8192c/r92c_chan.c Wed Apr 12 06:24:35 2017
(r316722)
+++ head/sys/dev/rtwn/rtl8192c/r92c_chan.c Wed Apr 12 07:21:54 2017
(r316723)
@@ -229,13 +229,13 @@ r92c_set_txpower(struct rtwn_softc *sc,
rtwn_r92c_get_txpower(sc, i, c, power);
#ifdef RTWN_DEBUG
if (sc->sc_debug & RTWN_DEBUG_TXPWR) {
- int ridx;
+ int max_mcs, ridx;
+
+ max_mcs = RTWN_RIDX_MCS(sc->ntxchains * 8 - 1);
/* Dump per-rate Tx power values. */
printf("Tx power for chain %d:\n", i);
- for (ridx = RTWN_RIDX_CCK1;
- ridx < RTWN_RIDX_COUNT;
- ridx++)
+ for (ridx = RTWN_RIDX_CCK1; ridx <= max_mcs; ridx++)
printf("Rate %d = %u\n", ridx, power[ridx]);
}
#endif
Modified: head/sys/dev/rtwn/rtl8812a/r12a_chan.c
==============================================================================
--- head/sys/dev/rtwn/rtl8812a/r12a_chan.c Wed Apr 12 06:24:35 2017
(r316722)
+++ head/sys/dev/rtwn/rtl8812a/r12a_chan.c Wed Apr 12 07:21:54 2017
(r316723)
@@ -247,7 +247,7 @@ r12a_get_txpower(struct rtwn_softc *sc,
if (sc->sc_debug & RTWN_DEBUG_TXPWR) {
/* Dump per-rate Tx power values. */
printf("Tx power for chain %d:\n", chain);
- for (ridx = RTWN_RIDX_CCK1; ridx < RTWN_RIDX_COUNT; ridx++)
+ for (ridx = RTWN_RIDX_CCK1; ridx <= max_mcs; ridx++)
printf("Rate %d = %u\n", ridx, power[ridx]);
}
#endif
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
