2021-08-03 14:50:14

by Colin King

Subject: [PATCH 3/3] rtlwifi: rtl8192de: fix array size limit in for-loop

From: Colin Ian King <[email protected]>

Currently the size of the entire array is being used in a for-loop
for the element count. While this works since the elements are u8
sized, it is preferred to use ARRAY_SIZE to get the element count
of the array.

Kudos to Joe Perches for spotting this issue.

Signed-off-by: Colin Ian King <[email protected]>
---
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
index 8ae69d914312..e11728622a9e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
@@ -1366,7 +1366,7 @@ u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl)
u8 place = chnl;

if (chnl > 14) {
- for (place = 14; place < sizeof(channel_all); place++) {
+ for (place = 14; place < ARRAY_SIZE(channel_all); place++) {
if (channel_all[place] == chnl)
return place - 13;
}
--
2.31.1

2021-08-03 18:21:40

by Joe Perches

Subject: Re: [PATCH 3/3] rtlwifi: rtl8192de: fix array size limit in for-loop

On Tue, 2021-08-03 at 15:49 +0100, Colin King wrote:
> From: Colin Ian King <[email protected]>
>
> Currently the size of the entire array is being used in a for-loop
> for the element count. While this works since the elements are u8
> sized, it is preferred to use ARRAY_SIZE to get the element count
> of the array.
[]
> diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
[]
> @@ -1366,7 +1366,7 @@ u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl)
> ? u8 place = chnl;
>
> ? if (chnl > 14) {
> - for (place = 14; place < sizeof(channel_all); place++) {
> + for (place = 14; place < ARRAY_SIZE(channel_all); place++) {
> ? if (channel_all[place] == chnl)
> ? return place - 13;
> ? }

Thanks.

It seems a relatively common copy/paste use in rtlwifi

$ git grep -P -n 'for\b.*<\s*sizeof\s*\(\s*\w+\w*\)\s*;' drivers/net/wireless/realtek/rtlwifi/
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:893: for (place = 14; place < sizeof(channel5g); place++) {
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:1368: for (place = 14; place < sizeof(channel_all); place++) {
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:2430: for (i = 0; i < sizeof(channel5g); i++)
drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c:2781: for (place = 14; place < sizeof(channel_all); place++) {
drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c:2170: for (place = 14; place < sizeof(channel_all); place++) {
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:3610: for (place = 14; place < sizeof(channel_all); place++)

2021-08-03 18:22:54

by Colin King

Subject: Re: [PATCH 3/3] rtlwifi: rtl8192de: fix array size limit in for-loop

On 03/08/2021 19:11, Joe Perches wrote:
> On Tue, 2021-08-03 at 15:49 +0100, Colin King wrote:
>> From: Colin Ian King <[email protected]>
>>
>> Currently the size of the entire array is being used in a for-loop
>> for the element count. While this works since the elements are u8
>> sized, it is preferred to use ARRAY_SIZE to get the element count
>> of the array.
> []
>> diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
> []
>> @@ -1366,7 +1366,7 @@ u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl)
>>   u8 place = chnl;
>>
>>   if (chnl > 14) {
>> - for (place = 14; place < sizeof(channel_all); place++) {
>> + for (place = 14; place < ARRAY_SIZE(channel_all); place++) {
>>   if (channel_all[place] == chnl)
>>   return place - 13;
>>   }
>
> Thanks.
>
> It seems a relatively common copy/paste use in rtlwifi

Urgh. Let's drop patch 3/3 for the moment. I'll send a fix later on, I'm
kinda tied up for the next 24 hours.


>
> $ git grep -P -n 'for\b.*<\s*sizeof\s*\(\s*\w+\w*\)\s*;' drivers/net/wireless/realtek/rtlwifi/
> drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:893: for (place = 14; place < sizeof(channel5g); place++) {
> drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:1368: for (place = 14; place < sizeof(channel_all); place++) {
> drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c:2430: for (i = 0; i < sizeof(channel5g); i++)
> drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c:2781: for (place = 14; place < sizeof(channel_all); place++) {
> drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c:2170: for (place = 14; place < sizeof(channel_all); place++) {
> drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:3610: for (place = 14; place < sizeof(channel_all); place++)
>
>
>

2021-08-21 17:32:41

by Kalle Valo

Subject: Re: [PATCH 3/3] rtlwifi: rtl8192de: fix array size limit in for-loop

Colin King <[email protected]> wrote:

> From: Colin Ian King <[email protected]>
>
> Currently the size of the entire array is being used in a for-loop
> for the element count. While this works since the elements are u8
> sized, it is preferred to use ARRAY_SIZE to get the element count
> of the array.
>
> Kudos to Joe Perches for spotting this issue.
>
> Signed-off-by: Colin Ian King <[email protected]>

Dropped per Colin's request.

Patch set to Changes Requested.

--
https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches