Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c4ca2e3c authored by Dedy Lansky's avatar Dedy Lansky Committed by Maya Erez
Browse files

wil6210: fix array out of bounds access in pmc 



Array index 'i' is used before limits check.
Fix this by doing limits check first.

Change-Id: I9a3d6f3165b3a0ba41dec3707d7c193a26ec6eb2
Signed-off-by: default avatarDedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: default avatarMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
Git-commit: 98a830a98dab6d474190bec72c4a4ad0f7f9bf75
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git


Signed-off-by: default avatarMaya Erez <merez@codeaurora.org>
parent b2b022ba

drivers/net/wireless/ath/wil6210/pmc.c

+2 −2
Original line number Diff line number Diff line
@@ -200,7 +200,7 @@ void wil_pmc_alloc(struct wil6210_priv *wil, 


release_pmc_skbs:

	wil_err(wil, "exit on error: Releasing skbs...\n");

	for (i = 0; pmc->descriptors[i].va && i < num_descriptors; i++) {

	for (i = 0; i < num_descriptors && pmc->descriptors[i].va; i++) {

		dma_free_coherent(dev,

				  descriptor_size,

				  pmc->descriptors[i].va,
@@ -283,7 +283,7 @@ void wil_pmc_free(struct wil6210_priv *wil, int send_pmc_cmd) 
		int i;



		for (i = 0;

		     pmc->descriptors[i].va && i < pmc->num_descriptors; i++) {

		     i < pmc->num_descriptors && pmc->descriptors[i].va; i++) {

			dma_free_coherent(dev,

					  pmc->descriptor_size,

					  pmc->descriptors[i].va,