From: Luca Coelho Date: Tue, 6 Nov 2018 06:24:12 +0000 (+0200) Subject: iwlwifi: make sure cur_fw_img is valid before accessing img X-Git-Tag: v5.1-rc1~178^2~348^2~43^2~24 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=9adcc117bc7d16e5ef226fec0a1d1f25765bf9ce;p=users%2Fjedix%2Flinux-maple.git iwlwifi: make sure cur_fw_img is valid before accessing img Harden the fwrt->fw->img array access by making sure the cur_fw_img value doesn't go out of bounds. Signed-off-by: Luca Coelho --- diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h index d8090d4b5c43..330229d2a61d 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h +++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h @@ -381,6 +381,7 @@ static inline bool iwl_fw_dbg_is_paging_enabled(struct iwl_fw_runtime *fwrt) { return iwl_fw_dbg_type_on(fwrt, IWL_FW_ERROR_DUMP_PAGING) && !fwrt->trans->cfg->gen2 && + fwrt->cur_fw_img < IWL_UCODE_TYPE_MAX && fwrt->fw->img[fwrt->cur_fw_img].paging_mem_size && fwrt->fw_paging_db[0].fw_paging_block; }