diff options
| author | Luca Coelho <luciano.coelho@intel.com> | 2018-11-06 08:24:12 +0200 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2019-01-29 16:10:30 +0200 |
| commit | 9adcc117bc7d16e5ef226fec0a1d1f25765bf9ce (patch) | |
| tree | f864551e85f7693f8fa65af8b2fb6e875b7f3f47 /drivers/net | |
| parent | 29cf396f08f6476935c445faddcaf90f2fe2fa87 (diff) | |
| download | linux-9adcc117bc7d16e5ef226fec0a1d1f25765bf9ce.tar.bz2 | |
iwlwifi: make sure cur_fw_img is valid before accessing img
Harden the fwrt->fw->img array access by making sure the cur_fw_img
value doesn't go out of bounds.
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h index d8090d4b5c43..330229d2a61d 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h +++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h @@ -381,6 +381,7 @@ static inline bool iwl_fw_dbg_is_paging_enabled(struct iwl_fw_runtime *fwrt) { return iwl_fw_dbg_type_on(fwrt, IWL_FW_ERROR_DUMP_PAGING) && !fwrt->trans->cfg->gen2 && + fwrt->cur_fw_img < IWL_UCODE_TYPE_MAX && fwrt->fw->img[fwrt->cur_fw_img].paging_mem_size && fwrt->fw_paging_db[0].fw_paging_block; } |