diff options
| author | Liad Kaufman <liad.kaufman@intel.com> | 2018-10-21 14:39:05 +0300 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2019-01-25 20:57:21 +0200 |
| commit | 162b22c93e66530405d793a830f75da3fc48ed31 (patch) | |
| tree | 725c22f459e4a15d55e28fc2eb85a64628d5474c /drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | |
| parent | 45dc7ba4b423cbec14fccbb17c884614aa2006f8 (diff) | |
iwlwifi: tighten boundary checks
The driver assumes certain sizes and lengths aren't crossed in some
places. Make sure this indeed happens.
Found by Klocwork.
Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c index 156ca1b1f621..af2791502b7d 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c @@ -214,7 +214,11 @@ static int iwl_pcie_gen2_set_tb(struct iwl_trans *trans, { struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); int idx = iwl_pcie_gen2_get_num_tbs(trans, tfd); - struct iwl_tfh_tb *tb = &tfd->tbs[idx]; + struct iwl_tfh_tb *tb; + + if (WARN_ON(idx >= IWL_NUM_OF_TBS)) + return -EINVAL; + tb = &tfd->tbs[idx]; /* Each TFD can point to a maximum max_tbs Tx buffers */ if (le16_to_cpu(tfd->num_tbs) >= trans_pcie->max_tbs) { |