From patchwork Wed Apr 5 11:58:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maya Erez X-Patchwork-Id: 9663839 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id AFAC360353 for ; Wed, 5 Apr 2017 12:00:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A056B26E4D for ; Wed, 5 Apr 2017 12:00:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 954AA28484; Wed, 5 Apr 2017 12:00:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4356D26E4D for ; Wed, 5 Apr 2017 12:00:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755130AbdDEL74 (ORCPT ); Wed, 5 Apr 2017 07:59:56 -0400 Received: from wolverine02.qualcomm.com ([199.106.114.251]:5508 "EHLO wolverine02.qualcomm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933036AbdDEL6h (ORCPT ); Wed, 5 Apr 2017 07:58:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qca.qualcomm.com; i=@qca.qualcomm.com; q=dns/txt; s=qcdkim; t=1491393517; x=1522929517; h=cc:from:to:subject:date:message-id:in-reply-to: references; bh=yzlJ+hNl/0HEwaOVMRF4o/ft/hGea8lLaGZvczKPP74=; b=Vsx1Wq2EkQGlVKM4FwCgz7JO+r2YPDd/O5AYZNWCpSLgIiCWevUZpm2P p2PQZWDvUuhb8QqF2X2/MmC7ZiD1WNGskMrjJGNcR+WixGeQ9XKC2cdLG QrA6NoXSJjpAGzq7BFU4h9uVhmy+D9VuSKlb4vUlNfyI66fAyNo1W+6X/ c=; X-IronPort-AV: E=Sophos;i="5.36,278,1486454400"; d="scan'208";a="371582774" Received: from unknown (HELO ironmsg02-L.qualcomm.com) ([10.53.140.109]) by wolverine02.qualcomm.com with ESMTP; 05 Apr 2017 04:58:37 -0700 Cc: Dedy Lansky , linux-wireless@vger.kernel.org, wil6210@qca.qualcomm.com, Maya Erez X-IronPort-AV: E=McAfee;i="5800,7501,8488"; a="899448768" X-MGA-submission: =?us-ascii?q?MDFEx3C0C7adNPcv3MCRrrKxD1woot6NXtvGZ3?= =?us-ascii?q?3eRprSZbEz99rW3lOeoEEkoFBREkk8GdkxjIT3mbsGkBgDYEu0/uImm1?= =?us-ascii?q?kyaTbHFKlsJmgoJW3yjoTuRWd6znx7giyx+NuRjjIEnLiTEVtLFbKTUK?= =?us-ascii?q?Qh?= Received: from lx-merez1.mea.qualcomm.com ([10.18.173.103]) by ironmsg02-L.qualcomm.com with ESMTP; 05 Apr 2017 04:58:35 -0700 From: Maya Erez To: Kalle Valo Subject: [PATCH 10/11] wil6210: fix array out of bounds access in pmc Date: Wed, 5 Apr 2017 14:58:13 +0300 Message-Id: <1491393494-11816-11-git-send-email-qca_merez@qca.qualcomm.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1491393494-11816-1-git-send-email-qca_merez@qca.qualcomm.com> References: <1491393494-11816-1-git-send-email-qca_merez@qca.qualcomm.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Dedy Lansky Array index 'i' is used before limits check. Fix this by doing limits check first. Signed-off-by: Dedy Lansky Signed-off-by: Maya Erez --- drivers/net/wireless/ath/wil6210/pmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/wil6210/pmc.c b/drivers/net/wireless/ath/wil6210/pmc.c index b067fdf..2e301b6 100644 --- a/drivers/net/wireless/ath/wil6210/pmc.c +++ b/drivers/net/wireless/ath/wil6210/pmc.c @@ -200,7 +200,7 @@ void wil_pmc_alloc(struct wil6210_priv *wil, release_pmc_skbs: wil_err(wil, "exit on error: Releasing skbs...\n"); - for (i = 0; pmc->descriptors[i].va && i < num_descriptors; i++) { + for (i = 0; i < num_descriptors && pmc->descriptors[i].va; i++) { dma_free_coherent(dev, descriptor_size, pmc->descriptors[i].va, @@ -283,7 +283,7 @@ void wil_pmc_free(struct wil6210_priv *wil, int send_pmc_cmd) int i; for (i = 0; - pmc->descriptors[i].va && i < pmc->num_descriptors; i++) { + i < pmc->num_descriptors && pmc->descriptors[i].va; i++) { dma_free_coherent(dev, pmc->descriptor_size, pmc->descriptors[i].va,