Commit acf42a95 authored by Mordechay Goodstein's avatar Mordechay Goodstein Committed by Luca Coelho
Browse files

iwlwifi: avoid access out of memory allocated 



The value in num_lmac can be bigger than mem_cfg->lmac array,
warn in case it's bigger.

Signed-off-by: default avatarMordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: 68025d5f ("iwlwifi: dbg: refactor dump code to improve readability")
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent b0d795a9

drivers/net/wireless/intel/iwlwifi/fw/dbg.c

+6 −0
Original line number Diff line number Diff line
@@ -748,6 +748,9 @@ static int iwl_fw_rxf_len(struct iwl_fw_runtime *fwrt, 
	ADD_LEN(fifo_len, mem_cfg->rxfifo2_size, hdr_len);



	/* Count RXF1 sizes */

	if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC))

		mem_cfg->num_lmacs = MAX_NUM_LMAC;



	for (i = 0; i < mem_cfg->num_lmacs; i++)

		ADD_LEN(fifo_len, mem_cfg->lmac[i].rxfifo1_size, hdr_len);
@@ -766,6 +769,9 @@ static int iwl_fw_txf_len(struct iwl_fw_runtime *fwrt, 
		goto dump_internal_txf;



	/* Count TXF sizes */

	if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC))

		mem_cfg->num_lmacs = MAX_NUM_LMAC;



	for (i = 0; i < mem_cfg->num_lmacs; i++) {

		int j;