Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74347856 authored by Franky Lin's avatar Franky Lin Committed by John W. Linville
Browse files

brcmfmac: add valid core index check in related functions 



Perform a valid check for core index to avoid illegal address access.

Reviewed-by: default avatarHante Meuleman <meuleman@broadcom.com>
Reviewed-by: default avatarPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: default avatarArend van Spriel <arend@broadcom.com>
Signed-off-by: default avatarFranky Lin <frankyl@broadcom.com>
Signed-off-by: default avatarArend van Spriel <arend@broadcom.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent fe040158

drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c

+10 −0
Original line number Diff line number Diff line
@@ -137,6 +137,8 @@ brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev, 
	u8 idx;



	idx = brcmf_sdio_chip_getinfidx(ci, coreid);

	if (idx == BRCMF_MAX_CORENUM)

		return false;



	regdata = brcmf_sdio_regrl(sdiodev,

				   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
@@ -155,6 +157,8 @@ brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev, 
	bool ret;



	idx = brcmf_sdio_chip_getinfidx(ci, coreid);

	if (idx == BRCMF_MAX_CORENUM)

		return false;



	regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,

				   NULL);
@@ -262,6 +266,8 @@ brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev, 
	u32 regdata;



	idx = brcmf_sdio_chip_getinfidx(ci, coreid);

	if (idx == BRCMF_MAX_CORENUM)

		return;



	/* if core is already in reset, just return */

	regdata = brcmf_sdio_regrl(sdiodev,
@@ -305,6 +311,8 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev, 
	u8 idx;



	idx = brcmf_sdio_chip_getinfidx(ci, coreid);

	if (idx == BRCMF_MAX_CORENUM)

		return;



	/*

	 * Must do the disable sequence first to work for
@@ -369,6 +377,8 @@ brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev, 
	u32 regdata;



	idx = brcmf_sdio_chip_getinfidx(ci, coreid);

	if (idx == BRCMF_MAX_CORENUM)

		return;



	/* must disable first to work for arbitrary current core state */

	brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, core_bits);