diff options
| author | Gregory Greenman <gregory.greenman@intel.com> | 2023-10-17 12:16:44 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2023-10-23 12:48:29 +0200 |
| commit | e25bd1853cc8308158d97e5b3696ea3689fa0840 (patch) | |
| tree | d857576bf05218053475ba75b3b09bf6dd1896c1 /drivers/net/wireless/intel/iwlwifi/mvm/link.c | |
| parent | 37fb29bd1f90f16d1abc95c0e9f0ff8eec9829ad (diff) | |
| download | linux-e25bd1853cc8308158d97e5b3696ea3689fa0840.tar.gz linux-e25bd1853cc8308158d97e5b3696ea3689fa0840.tar.bz2 linux-e25bd1853cc8308158d97e5b3696ea3689fa0840.zip | |
wifi: iwlwifi: mvm: fix size check for fw_link_id
Check that fw_link_id does not exceed the size of link_id_to_link_conf
array. There's no any codepath that can cause that, but it's still
safer to verify in case fw_link_id gets corrupted.
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20231017115047.3385bd11f423.I2d30fdb464f951c648217553c47901857a0046c7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/link.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/link.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/link.c b/drivers/net/wireless/intel/iwlwifi/mvm/link.c index d0d5ebc03d53..c3831440a019 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/link.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/link.c @@ -60,7 +60,7 @@ int iwl_mvm_add_link(struct iwl_mvm *mvm, struct ieee80211_vif *vif, if (link_info->fw_link_id == IWL_MVM_FW_LINK_ID_INVALID) { link_info->fw_link_id = iwl_mvm_get_free_fw_link_id(mvm, mvmvif); - if (link_info->fw_link_id == IWL_MVM_FW_LINK_ID_INVALID) + if (link_info->fw_link_id >= ARRAY_SIZE(mvm->link_id_to_link_conf)) return -EINVAL; rcu_assign_pointer(mvm->link_id_to_link_conf[link_info->fw_link_id], @@ -243,7 +243,7 @@ int iwl_mvm_remove_link(struct iwl_mvm *mvm, struct ieee80211_vif *vif, int ret; if (WARN_ON(!link_info || - link_info->fw_link_id == IWL_MVM_FW_LINK_ID_INVALID)) + link_info->fw_link_id >= ARRAY_SIZE(mvm->link_id_to_link_conf))) return -EINVAL; RCU_INIT_POINTER(mvm->link_id_to_link_conf[link_info->fw_link_id], |