Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 31 Aug 2021 11:18:02 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Luca Coelho <luciano.coelho@intel.com>,
        Johannes Berg <johannes.berg@intel.com>
Cc:     Kalle Valo <kvalo@codeaurora.org>,
        Emmanuel Grumbach <emmanuel.grumbach@intel.com>,
        Mordechay Goodstein <mordechay.goodstein@intel.com>,
        Sara Sharon <sara.sharon@intel.com>,
        Naftali Goldstein <naftali.goldstein@intel.com>,
        Dan Halperin <Dan1.Halperin@intel.com>,
        linux-wireless@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH 1/2] iwlwifi: mvm: d3: Fix off by ones in
 iwl_mvm_wowlan_get_rsc_v5_data()
Message-ID: <20210831081802.GA9846@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?1KGIvKTxIrH1g6BJp8uRQGy/YcKZyl4RKIl1OgodnbRx4pX84pjUQhM7+lpy?=
 =?us-ascii?Q?6dHOnP4cSK33bbVyKqoKr42EKmq4/WioEWJsEdnUDDP2MQX0zDMw4OPDa2fP?=
 =?us-ascii?Q?QpDl5Edj5IpA45+WszUOPsPlf6vz3rA4Cd+J89q/tglkC/BHpBPwV4oFlXzR?=
 =?us-ascii?Q?SA9+dRsMR7OaRi0W/aDOL8ps9TZ7LlgKe0v1rVqXj77DuZK+EbOjxIFEiosR?=
 =?us-ascii?Q?yTCQEYDHycs5dZ3xggqbukkjhFysGmffQWUFW4BIiPBWmfNQddHRl2uh5Wo3?=
 =?us-ascii?Q?5wW2DBehHAc/Zqzw3VFti3zycJbPetpvWuKZmq8vTDCw+T8T2yaI3G5eg23K?=
 =?us-ascii?Q?g07GDQzwobzIlvvXgVU9sx1xZf2xr4Us15UYUgBSeD+r2igoq7QbOIrP9IGp?=
 =?us-ascii?Q?dXN5lmkXJwgKN6ldKS1W3+AQ9UgH8BE7HsMnb/0QGmF6KxfGLIj0gSJ4KHSQ?=
 =?us-ascii?Q?XWT88WapfRPJnpr6guvU6AB+0ZEzui+TV/sYMWHhZ9JAZPyND6SDQpIEQz4d?=
 =?us-ascii?Q?adTIQ0t+mOTZW57QmG/h7krvC1fpWuSoxW1YwjNT4NFl5MMTnmklhqtl2JQr?=
 =?us-ascii?Q?y1WrKiYWmtvEwsURnf0sKwdapSjFuCjbcl4DvsySPSLfw7ROCOqZO55SxX0I?=
 =?us-ascii?Q?F8It9V2i6n5WnNwQMAYXMJ268nkzvZg7LFMlFj3KUU06nsmC/0N9LX+Mx3m8?=
 =?us-ascii?Q?Q07OzmK7DjWoGl1mTm2way2FLL0gBCPTfFy6XH9Twmnnoj2HxYwbMAsavqoM?=
 =?us-ascii?Q?fT0355Ns5Gm0JYsAraNoQbcvrlQMxH0FY9Pe9E3MzX1ayj1SeNeC20HR32dV?=
 =?us-ascii?Q?GPDArE50/ACQTb3VKW9UWpgldLUZlP45c+wLkhmxoj4SPHKPiA0oEM/3X1n7?=
 =?us-ascii?Q?mo7PUUuEGVPPQlqQTr3TXFrsBE00niwnlkTMeUzQ0gzN2xNE2bD0SUzFqJeK?=
 =?us-ascii?Q?EKAFmcel1QLy4Rxegl2V3KZwXjJ5zQTy2NiaMyH2rmDElOf6oGgpNvpLebo6?=
 =?us-ascii?Q?jNb1FnJaOQlcSLYjouEZ04cym3eyyxCldw1oHsS8vPYPF7t7/L79dzi9yXBb?=
 =?us-ascii?Q?9lITLRIe/i3QK26uOe9JA8kdQDXeCqhpXNrSM60cB4IemK8QVMiHWm06mOQL?=
 =?us-ascii?Q?oh6mpWw713z3JyVBhLegsLP6Cy0nKEb/GUJ0FN/+WznUd3ewKlkmofA6UrsI?=
 =?us-ascii?Q?CWHDRFJksTABKB0SjyXuup9waQBYEWSUMsnFZKzL9YFlf75uiMFKwEmei4g4?=
 =?us-ascii?Q?z7EAT+4eUthhRerL77egt2ehZYBrmGwDRcMW6Ntvv+CcVmAVl3yGoeFu0ywa?=
 =?us-ascii?Q?Rc29ECislbpohDeHSzhcN83GS1zv07BEe3dI+MMX37RSuJijr+LWMczU3C1t?=
 =?us-ascii?Q?KdbCV2o=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 92023c6c-0263-4581-f1dc-08d96c57eb20
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Aug 2021 08:18:31.4504
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: HEJkloHgM7kzo8vST70wdV5MFeDFAW9hGRlsrjRu5bueZH2lqH1WujgntbvRKGmOSiojpGbMKHcvDwwXQBfcpuTn177E7EgDcpHcFzpuySs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO6PR10MB5412
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10092 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 bulkscore=0 phishscore=0
 spamscore=0 mlxlogscore=999 adultscore=0 suspectscore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000
 definitions=main-2108310047
X-Proofpoint-GUID: n80ymvik836bRaJlosx7dsGuSLZZpl2S
X-Proofpoint-ORIG-GUID: n80ymvik836bRaJlosx7dsGuSLZZpl2S
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

These should be >= ARRAY_SIZE() instead of > ARRAY_SIZE() to prevent an
out of bounds write on the next line.

Fixes: 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 0e97d5e6c644..6e3a63a5a75c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -360,11 +360,11 @@ static void iwl_mvm_wowlan_get_rsc_v5_data(struct ieee80211_hw *hw,
 	if (sta) {
 		rsc = data->rsc->ucast_rsc;
 	} else {
-		if (WARN_ON(data->gtks > ARRAY_SIZE(data->gtk_ids)))
+		if (WARN_ON(data->gtks >= ARRAY_SIZE(data->gtk_ids)))
 			return;
 		data->gtk_ids[data->gtks] = key->keyidx;
 		rsc = data->rsc->mcast_rsc[data->gtks % 2];
-		if (WARN_ON(key->keyidx >
+		if (WARN_ON(key->keyidx >=
 				ARRAY_SIZE(data->rsc->mcast_key_id_map)))
 			return;
 		data->rsc->mcast_key_id_map[key->keyidx] = data->gtks % 2;
-- 
2.20.1