Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753316AbbHNHEU (ORCPT ); Fri, 14 Aug 2015 03:04:20 -0400 Received: from mail-wi0-f182.google.com ([209.85.212.182]:37820 "EHLO mail-wi0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752426AbbHNHES (ORCPT ); Fri, 14 Aug 2015 03:04:18 -0400 Date: Fri, 14 Aug 2015 09:04:08 +0200 From: Adrien Schildknecht To: "Grumbach, Emmanuel" Cc: "Berg, Johannes" , "ilw@linux.intel.com" , "kvalo@codeaurora.org" , "linux-wireless@vger.kernel.org" , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] iwlwifi: out-of-bounds access in iwl_init_sband_channels Message-ID: <20150814090408.1521e8fe.adrien+dev@schischi.me> In-Reply-To: <0BA3FCBA62E2DC44AF3030971E174FB32E7EA2CE@hasmsx107.ger.corp.intel.com> References: <1439512532-7901-1-git-send-email-adrien+dev@schischi.me> <0BA3FCBA62E2DC44AF3030971E174FB32E7EA2CE@hasmsx107.ger.corp.intel.com> X-Mailer: Claws Mail 3.12.0 (GTK+ 2.24.28; x86_64-unknown-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 965 Lines: 26 Hi, > On 08/14/2015 03:36 AM, Adrien Schildknecht wrote: > > Both loops of this function compare data from the 'chan' array and > > then check if the index is valid. > > > > The 2 conditions should be inverted to avoid an out-of-bounds > > access. > > > > Was that found by a static analyzer or any other automated tool, or > was that the result of your very careful review? The error has been reported by KASan: ================================================================== BUG: KASan: out of bounds access in iwl_init_sband_channels+0x207/0x260 [iwlwifi] at addr ffff8800c2d0aac8 Read of size 4 by task modprobe/329 ================================================================== -- Adrien Schildknecht -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/