Received-SPF: pass (google.com: domain of linux-wireless+bounces-7234-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Message-ID: <8292faa6-a2f6-4b43-8d60-9eeba85aa6b1@oracle.com>
Date: Mon, 6 May 2024 12:03:15 -0700
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: arend.vanspriel@broadcom.com, linville@tuxdriver.com
Cc: linux-wireless@vger.kernel.org
From: samasth.norway.ananda@oracle.com
Subject: Buffer overrun error found in brcm80211 driver code
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?aERHeGdPbmNwSHR3b3A2TXZibFJFdVdmOWlzTUZ6ZGJpa1RzalV5c0todjhK?=
 =?utf-8?B?VVpTYktEalJENXlzRUNSZHpVb3MyWjdMekU3d01MNFgvNGhReEJ4cTZDWTdy?=
 =?utf-8?B?K0VUZTV6dURIY0xybXp5NVp0eDVqQ29PV3VWUjNVVjI5bGRodEZjR29mQk03?=
 =?utf-8?B?VTVLbWFiZUNzTk4rKzhHVEpKTDFLWk1oYXBuaytRR21pdUxVTnEvR3krT05Z?=
 =?utf-8?B?eVEyNjJQaTdhVzlPelFyZVdqUGNQSnJmVisrOW5BWVZVVzNYTmliWlJNRmM3?=
 =?utf-8?B?UzI1cjFMTkVMd01JRE9kUGNlaWxabVBWS25ic1NCTEpPWERSb3dmMTRuUzVm?=
 =?utf-8?B?WTdpWHZLb1VpTHNQNFBZZHhBck5wY2VOWmtEUDM2azFCZXNQbjJVOUZHNG1n?=
 =?utf-8?B?bW1kU1dXOU5kR1ZaeEpXbXVTU3dYbllaVy84cVhqYSt4WXU3alhrdjUyQ2JV?=
 =?utf-8?B?c2Z6VkczZ0poRThkdjl6ZjkycWRucFV6c015UVJYelA0QzZMZHZ6QXFhZDVZ?=
 =?utf-8?B?Nk8raFlhZmtiTzN4aEJOZkJKbjk2aXU0NDZ4QTJtTk94M2NkMWtSNFp6Y2N0?=
 =?utf-8?B?MHhtSmtqOXgvVnFQcUN0TWF6MEVPOFBlSDF5UlpOaWNmc1FlOXV4a2czUTNG?=
 =?utf-8?B?WG1iOXdiRm9DNm5GNFhadHJBV0gxQi9EdnhTWTUrUTYzaXJnNWVCUGF1Y3dQ?=
 =?utf-8?B?ZkJyY0ozdnNSd3Bjdk0vcnZxZVVOQVlWWXBaNG9qaEZPOGZCVkZ3cHJtZGFh?=
 =?utf-8?B?S0FlVkd4MzlvL0paVGFMV2NCMmM5ZGRpek9xaDN6bU9WOGd3OUY0ODJHNUh3?=
 =?utf-8?B?NnpqVGpJUWc4dmlnVVBZNktkcjB6czBVQmx0NEtnRVNGWmVGLytickJXWC90?=
 =?utf-8?B?Tm5XeWErcVJ6elN3aTJEMy9YU0hXSzF1ZG8vbHpaSUpuTG91RndUMDI0QmRD?=
 =?utf-8?B?M0s2ZFJPWGFWN0RjMWpYS3N0SDlQNy80dWxlc3M3cWxOSzB4eXMrVGhIUWR0?=
 =?utf-8?B?RHM2azd2aTlZOWVTTTlvcklNTHRzUERJTnZJT0oxaWxQRHZDZVZvK2dsbk0w?=
 =?utf-8?B?V0R2UlRibEorNVdkZVVTWkVXNFFrSWw5N0xkaGh4MlJrMmR3aEsycC9yUy8x?=
 =?utf-8?B?R1V1eW5wc3lXTXhvSkloUmFYa09qSUNCV1BEY2V4Z0NSejV5NnIwanBkcFhC?=
 =?utf-8?B?R2NjZm1hTHliTlFLYmhTdWc3ZnRrc2dWditEVEg5QVMrcHpvVnBNa1RQMkQy?=
 =?utf-8?B?TkdTWGNjbUZkNUpVZFlERDhXa2VmUE5La0txRVlETnYyRzdtSTZ6TFlZUVlB?=
 =?utf-8?B?SHhYMTlLbUE5OWVGekhJMEd0VFkzbzZ3WkJSaDBzNnAzTDBqcElQWkY4YWFQ?=
 =?utf-8?B?bVZLajFJblQzTWg0d2JjS3ZKTC9SYWRYMmdMdlhpeG1nK1cxTUkyRlRNRnYz?=
 =?utf-8?B?angzODRFUUN0UUp3VjZHaWcrOEE3OG1jQ0djZkZpakxoTS93cU9McCtJdzZV?=
 =?utf-8?B?N3NuVFdnV3FHakZxcENibWFZVkRwQWhaaE9vZEhEdUNPMWR1a2tLUnFqMG9x?=
 =?utf-8?B?MVBsRzN2RnBTY08zQVVUMTNOSjlMOGNxNzE5aXNWL3pVZkYvL1h2WlhWRjZs?=
 =?utf-8?B?a1lBTEZjUVNOVWhDUjVaLzJQRTRnSmhrcUJMdzd1UHBMMjNRbGVDYld0NVlV?=
 =?utf-8?B?b1E4K04wcGNUdjlOYVY2dE9WbkhwalJhTEJxS0xrckkvYzdmcGtzMnBYTTNC?=
 =?utf-8?B?TGJyaUszWXdhYnhadzNmMTRZb3ZYS1crSjJmNUdWbWJsQWVpcEFoeEJhbmRi?=
 =?utf-8?B?enY0SXVHTW1vazZmdnQzaTVhRGNVMzBDazRGcFNzVUNhRjBpVUpreXZKNUJw?=
 =?utf-8?B?aDlCR1BON3J0cXFJa3AxSzU0a3N6elFDczl0ajU0Y09ITTRlQ1J4SW1PdnNu?=
 =?utf-8?B?L292NUJ5VWtiaFJPbWVEYlZ3MnY3TEpDZWE0M3RkRHVKMUxtQStablpyYWow?=
 =?utf-8?B?dThJWjlZbmNHRlhCa0FDMnFNc0ZHTmZuSTN5SzQxOW83N2ZNVWFWaGV4MXNp?=
 =?utf-8?B?QWlFQjMxcGJIQVRSLzlkNTVTSG5ZZFFjUTVwd3REZUhrTThuTHVHZXY0RG9H?=
 =?utf-8?B?eU0zZk9HSnQwMkRITDN3eFdJN0t6Z1IrSnlKUDZuMVpONmFhY0krTEZDZGR5?=
 =?utf-8?Q?w8FijKMTRtPBDrx7gKafFZ8=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	aQ6e2Qg8B1QckRoHiTHmhGmnceAOugoySCs9DbxM49XyV+8ShwZXA9oqJpPPkEAJ5JDsaS+YkGqiuHSGLXiYNjMsa2bYEEd7hHgxwnwtgfOX1FqNQVwHODo2Arov/opuFGD16yGa/fE9m8RmRK9YQnh3sYJ85Rdhdo4fSpfRZKF8hJwzeepcAJt9gH6O++ZLJ+87TQJmOkcebclN8j901RB6lGUl4XZSTycJfr6QoXls0j2yn4O3WjdnsmSgUMysYm3QxDlaLIB0MJQxe1wa8gjJyNJhMLrRvaB2+DNG4+TzSqexiBftkL1wmB5088VvGIc+s6NXyKw2w7TM5mACW0nIGQG6N6+LKKeWGiqqriYH8R+5M0hxoRUYWYzbX2xIRriswRDaGyyfLpvRHLzeAF8zZjsZfkconAiPQKJ6hqdTmnmuaOWfYnAZUyaT/e5fwh0pqXT1J7REHCBw7WR1af9odmF6mRTywomFDJL86mzS0uelGLnk/wUmqVcksABqJprPDjfGZBNClmCQlfSdECljiInsU/UGlJdnY2pTcJ8JMpoy4ABpI1a46+6Z18eWJAvrVpwU+iO/PBdR/TAqEDm80+D9472CEjUOwIDaPyc=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 079d2151-2fb2-489f-ab2e-08dc6dff325d
X-MS-Exchange-CrossTenant-AuthSource: DM6PR10MB3817.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 May 2024 19:03:21.1160
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 8YsVfSgViazvkRtB6G9wxOBi3atR1KKr3wU2gGdMypsxfEO0FcTTb3E8kwW+ugHOpY9B7C0Pv/dK3rX/4cyvPMG3JNhIFP+DtdeYzsvvbhr1eM7cNLBMBworZtr+OL0/
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW5PR10MB5851
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.11.176.26
 definitions=2024-05-06_13,2024-05-06_02,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxlogscore=999
 bulkscore=0 suspectscore=0 spamscore=0 malwarescore=0 mlxscore=0
 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2404010000 definitions=main-2405060137
X-Proofpoint-GUID: jSPG6YUxAjT1SFSJ2bNWksm5_P6S9aQq
X-Proofpoint-ORIG-GUID: jSPG6YUxAjT1SFSJ2bNWksm5_P6S9aQq

Hi,


I came across an issue reported by an internal static analysis tool when 
tested on the code for brcm80211 driver.

The commit which introduced is -
5b435de0d786869c95d1962121af0d7df2542009
("net: wireless: add brcm80211 drivers")


In the file -
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c

within the function wlc_lcnphy_tx_iqlo_cal()

we assign value to band_idx as below
band_idx = (CHSPEC_IS5G(pi->radio_chanspec) ? 1 : 0);
 From this band_idx could be either 1 or 0.

But when we look at the array iqcal_gainparams_numgains_lcnphy[] at
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c

We can notice that it is initialized with only one value in it.

static const u16 iqcal_gainparams_numgains_lcnphy[1] = {
     ARRAY_SIZE(tbl_iqcal_gainparams_lcnphy_2G),
};


So, when we try to access iqcal_gainparams_numgains_lcnphy[band_idx]
within the for loop in the same function we could be reading a wrong 
value of  iqcal_gainparams_numgains_lcnphy[1]

Do you have any suggestion on how we can resolve this?
Is it possible to keep band_idx to just 0?


Thanks,
Samasth.