⬢ DragonFlyBSD Kernel Audit
DF-4519 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
--- a/sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar5212_xmit.c
@@ -88,7 +88,8 @@
 	struct ath_hal_5212 *ahp = AH5212(ah);
 	HAL_CAPABILITIES *pCap = &AH_PRIVATE(ah)->ah_caps;
 
-	if (q >= pCap->halTotalQueues) {
+	/* NB: q is signed; reject negative before it reaches ah_txq[] */
+	if (q < 0 || q >= pCap->halTotalQueues) {
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
 		    __func__, q);
 		return AH_FALSE;
@@ -106,7 +107,8 @@
 	HAL_CAPABILITIES *pCap = &AH_PRIVATE(ah)->ah_caps;
 
 
-	if (q >= pCap->halTotalQueues) {
+	/* NB: q is signed; reject negative before it reaches ah_txq[] */
+	if (q < 0 || q >= pCap->halTotalQueues) {
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
 		    __func__, q);
 		return AH_FALSE;
@@ -514,7 +516,11 @@
 uint32_t
 ar5212GetTxDP(struct ath_hal *ah, u_int q)
 {
-	HALASSERT(q < AH_PRIVATE(ah)->ah_caps.halTotalQueues);
+	if (q >= AH_PRIVATE(ah)->ah_caps.halTotalQueues) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return 0;
+	}
 	return OS_REG_READ(ah, AR_QTXDP(q));
 }
 
@@ -524,7 +530,11 @@
 HAL_BOOL
 ar5212SetTxDP(struct ath_hal *ah, u_int q, uint32_t txdp)
 {
-	HALASSERT(q < AH_PRIVATE(ah)->ah_caps.halTotalQueues);
+	if (q >= AH_PRIVATE(ah)->ah_caps.halTotalQueues) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 	HALASSERT(AH5212(ah)->ah_txq[q].tqi_type != HAL_TX_QUEUE_INACTIVE);
 
 	/*
@@ -544,7 +554,11 @@
 HAL_BOOL
 ar5212StartTxDma(struct ath_hal *ah, u_int q)
 {
-	HALASSERT(q < AH_PRIVATE(ah)->ah_caps.halTotalQueues);
+	if (q >= AH_PRIVATE(ah)->ah_caps.halTotalQueues) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 
 	HALASSERT(AH5212(ah)->ah_txq[q].tqi_type != HAL_TX_QUEUE_INACTIVE);
 
@@ -566,7 +580,11 @@
 {
 	uint32_t npend;
 
-	HALASSERT(q < AH_PRIVATE(ah)->ah_caps.halTotalQueues);
+	if (q >= AH_PRIVATE(ah)->ah_caps.halTotalQueues) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return 0;
+	}
 	HALASSERT(AH5212(ah)->ah_txq[q].tqi_type != HAL_TX_QUEUE_INACTIVE);
 
 	npend = OS_REG_READ(ah, AR_QSTS(q)) & AR_Q_STS_PEND_FR_CNT;
@@ -591,7 +609,11 @@
 	u_int i;
 	u_int wait;
 
-	HALASSERT(q < AH_PRIVATE(ah)->ah_caps.halTotalQueues);
+	if (q >= AH_PRIVATE(ah)->ah_caps.halTotalQueues) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 
 	HALASSERT(AH5212(ah)->ah_txq[q].tqi_type != HAL_TX_QUEUE_INACTIVE);