iwlwifi: avoid access out of memory allocated

The value in num_lmac can be bigger than mem_cfg->lmac array,
warn in case it's bigger.

Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: 68025d5f9bfe ("iwlwifi: dbg: refactor dump code to improve readability")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index 56e99b5661f7608f32760578fe184bf2dff0aa05..a97bf17da14d41c744cfd8cef47ccf7a3340ef31 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -748,6 +748,9 @@ static int iwl_fw_rxf_len(struct iwl_fw_runtime *fwrt,
        ADD_LEN(fifo_len, mem_cfg->rxfifo2_size, hdr_len);
 
        /* Count RXF1 sizes */
+       if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC))
+               mem_cfg->num_lmacs = MAX_NUM_LMAC;
+
        for (i = 0; i < mem_cfg->num_lmacs; i++)
                ADD_LEN(fifo_len, mem_cfg->lmac[i].rxfifo1_size, hdr_len);
 
@@ -766,6 +769,9 @@ static int iwl_fw_txf_len(struct iwl_fw_runtime *fwrt,
                goto dump_internal_txf;
 
        /* Count TXF sizes */
+       if (WARN_ON(mem_cfg->num_lmacs > MAX_NUM_LMAC))
+               mem_cfg->num_lmacs = MAX_NUM_LMAC;
+
        for (i = 0; i < mem_cfg->num_lmacs; i++) {
                int j;