Przeglądaj źródła

[ath9k] Fix buffer overrun for ar9287

This backport is from linux kernel upstream commit 83d6f1f ("ath9k:
fix buffer overrun for ar9287").

Signed-off-by: Christian Hesse <mail@eworm.de>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Christian Hesse 8 lat temu
rodzic
commit
858f56e68b
1 zmienionych plików z 3 dodań i 4 usunięć
  1. 3
    4
      src/drivers/net/ath/ath9k/ath9k_eeprom.c

+ 3
- 4
src/drivers/net/ath/ath9k/ath9k_eeprom.c Wyświetl plik

@@ -368,10 +368,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
368 368
 
369 369
 	if (match) {
370 370
 		if (AR_SREV_9287(ah)) {
371
-			/* FIXME: array overrun? */
372 371
 			for (i = 0; i < numXpdGains; i++) {
373 372
 				minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
374
-				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
373
+				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
375 374
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
376 375
 						data_9287[idxL].pwrPdg[i],
377 376
 						data_9287[idxL].vpdPdg[i],
@@ -381,7 +380,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
381 380
 		} else if (eeprom_4k) {
382 381
 			for (i = 0; i < numXpdGains; i++) {
383 382
 				minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
384
-				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
383
+				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
385 384
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
386 385
 						data_4k[idxL].pwrPdg[i],
387 386
 						data_4k[idxL].vpdPdg[i],
@@ -391,7 +390,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
391 390
 		} else {
392 391
 			for (i = 0; i < numXpdGains; i++) {
393 392
 				minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
394
-				maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
393
+				maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
395 394
 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
396 395
 						data_def[idxL].pwrPdg[i],
397 396
 						data_def[idxL].vpdPdg[i],

Ładowanie…
Anuluj
Zapisz