xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iwlwifi: avoid access out of memory allocated

Browse Source 
The value in num_lmac can be bigger than mem_cfg->lmac array,
warn in case it's bigger.

Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: 68025d5f9b ("iwlwifi: dbg: refactor dump code to improve readability")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
This commit is contained in:
Mordechay Goodstein
2018-10-21 18:48:13 +03:00
committed by Luca Coelho
parent b0d795a9ae
commit acf42a957e
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/wireless/intel/iwlwifi/fw/dbg.c
View File

@@ -748,6 +748,9 @@ static int iwl_fw_rxf_len(struct iwl_fw_runtime *fwrt,
ADD_LEN(fifo_len, mem_cfg->rxfifo2_size, hdr_len);
/* Count RXF1 sizes */
if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC))
mem_cfg->num_lmacs = MAX_NUM_LMAC;
for (i = 0; i < mem_cfg->num_lmacs; i++)
ADD_LEN(fifo_len, mem_cfg->lmac[i].rxfifo1_size, hdr_len);
@@ -766,6 +769,9 @@ static int iwl_fw_txf_len(struct iwl_fw_runtime *fwrt,
goto dump_internal_txf;
/* Count TXF sizes */
if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC))
mem_cfg->num_lmacs = MAX_NUM_LMAC;
for (i = 0; i < mem_cfg->num_lmacs; i++) {
int j;