diff options
| author |   Mordechay Goodstein <mordechay.goodstein@intel.com> | 2018-10-21 18:48:13 +0300 |
|---|---|---|
| committer |   Luca Coelho <luciano.coelho@intel.com> | 2019-01-25 20:57:21 +0200 |
| commit | acf42a957e341abcafd28d5e89a5e8bfffd67989 (patch) | |
| tree | 6f94ea1267ce8720c81c7569539f98c1f9971e09 | |
| parent | iwlwifi: mvm: avoid possible access out of array. (diff) | |
iwlwifi: avoid access out of memory allocated
The value in num_lmac can be bigger than mem_cfg->lmac array,
warn in case it's bigger.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: 68025d5f9bfe ("iwlwifi: dbg: refactor dump code to improve readability")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c index 56e99b5661f7..a97bf17da14d 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c @@ -748,6 +748,9 @@ static int iwl_fw_rxf_len(struct iwl_fw_runtime *fwrt, ADD_LEN(fifo_len, mem_cfg->rxfifo2_size, hdr_len); /* Count RXF1 sizes */ + if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC)) + mem_cfg->num_lmacs = MAX_NUM_LMAC; + for (i = 0; i < mem_cfg->num_lmacs; i++) ADD_LEN(fifo_len, mem_cfg->lmac[i].rxfifo1_size, hdr_len); @@ -766,6 +769,9 @@ static int iwl_fw_txf_len(struct iwl_fw_runtime *fwrt, goto dump_internal_txf; /* Count TXF sizes */ + if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC)) + mem_cfg->num_lmacs = MAX_NUM_LMAC; + for (i = 0; i < mem_cfg->num_lmacs; i++) { int j; |