Merge "wil6210: fix array out of bounds access in pmc" into msm-4.9 (f8014a6f) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/net/wireless/ath/wil6210/pmc.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -200,7 +200,7 @@ void wil_pmc_alloc(struct wil6210_priv *wil,

		release_pmc_skbs:
		wil_err(wil, "exit on error: Releasing skbs...\n");
		for (i = 0; pmc->descriptors[i].va && i < num_descriptors; i++) {
		for (i = 0; i < num_descriptors && pmc->descriptors[i].va; i++) {
		dma_free_coherent(dev,
		descriptor_size,
		pmc->descriptors[i].va,
		@@ -283,7 +283,7 @@ void wil_pmc_free(struct wil6210_priv *wil, int send_pmc_cmd)
		int i;

		for (i = 0;
		pmc->descriptors[i].va && i < pmc->num_descriptors; i++) {
		i < pmc->num_descriptors && pmc->descriptors[i].va; i++) {
		dma_free_coherent(dev,
		pmc->descriptor_size,
		pmc->descriptors[i].va,