Commit 98a830a9 authored by Dedy Lansky's avatar Dedy Lansky Committed by Kalle Valo

wil6210: fix array out of bounds access in pmc

Array index 'i' is used before limits check.
Fix this by doing limits check first.
Signed-off-by: default avatarDedy Lansky <qca_dlansky@qca.qualcomm.com>
Signed-off-by: default avatarMaya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent bd50e268
...@@ -200,7 +200,7 @@ void wil_pmc_alloc(struct wil6210_priv *wil, ...@@ -200,7 +200,7 @@ void wil_pmc_alloc(struct wil6210_priv *wil,
release_pmc_skbs: release_pmc_skbs:
wil_err(wil, "exit on error: Releasing skbs...\n"); wil_err(wil, "exit on error: Releasing skbs...\n");
for (i = 0; pmc->descriptors[i].va && i < num_descriptors; i++) { for (i = 0; i < num_descriptors && pmc->descriptors[i].va; i++) {
dma_free_coherent(dev, dma_free_coherent(dev,
descriptor_size, descriptor_size,
pmc->descriptors[i].va, pmc->descriptors[i].va,
...@@ -283,7 +283,7 @@ void wil_pmc_free(struct wil6210_priv *wil, int send_pmc_cmd) ...@@ -283,7 +283,7 @@ void wil_pmc_free(struct wil6210_priv *wil, int send_pmc_cmd)
int i; int i;
for (i = 0; for (i = 0;
pmc->descriptors[i].va && i < pmc->num_descriptors; i++) { i < pmc->num_descriptors && pmc->descriptors[i].va; i++) {
dma_free_coherent(dev, dma_free_coherent(dev,
pmc->descriptor_size, pmc->descriptor_size,
pmc->descriptors[i].va, pmc->descriptors[i].va,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment