A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 14:19:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

iwlwifi: avoid access out of memory allocated

Browse source 
The value in num_lmac can be bigger than mem_cfg->lmac array,
warn in case it's bigger.

Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: 68025d5f9b ("iwlwifi: dbg: refactor dump code to improve readability")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
This commit is contained in:
Mordechay Goodstein 2018-10-21 18:48:13 +03:00 • committed by Luca Coelho
commit acf42a957e
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
drivers/net/wireless/intel/iwlwifi/fw/dbg.c
View file

@ -748,6 +748,9 @@ static int iwl_fw_rxf_len(struct iwl_fw_runtime *fwrt,
ADD_LEN(fifo_len, mem_cfg->rxfifo2_size, hdr_len);
/* Count RXF1 sizes */
if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC))
mem_cfg->num_lmacs = MAX_NUM_LMAC;
for (i = 0; i < mem_cfg->num_lmacs; i++)
ADD_LEN(fifo_len, mem_cfg->lmac[i].rxfifo1_size, hdr_len);
@ -766,6 +769,9 @@ static int iwl_fw_txf_len(struct iwl_fw_runtime *fwrt,
goto dump_internal_txf;
/* Count TXF sizes */
if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC))
mem_cfg->num_lmacs = MAX_NUM_LMAC;
for (i = 0; i < mem_cfg->num_lmacs; i++) {
int j;