diff options
| author | Ahmad Masri <amasri@codeaurora.org> | 2019-02-28 12:34:52 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2019-04-03 15:34:47 +0300 |
| commit | e4a29bdd8f82627d88644971235dc12b70c4150b (patch) | |
| tree | 5b3389bcbfd5e47935c975083efe83a94abd30ee /drivers/net/wireless/ath/wil6210/main.c | |
| parent | 044974fbeadee4a5c0554ee7d83d22495ad3d450 (diff) | |
| download | linux-e4a29bdd8f82627d88644971235dc12b70c4150b.tar.xz | |
wil6210: check mid is valid
Check that the mid is valid and that it does not exceed the memory
size allocated to vifs array.
Signed-off-by: Ahmad Masri <amasri@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/ath/wil6210/main.c')
| -rw-r--r-- | drivers/net/wireless/ath/wil6210/main.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c index f2432adeec3e..6a6bfb3b25ca 100644 --- a/drivers/net/wireless/ath/wil6210/main.c +++ b/drivers/net/wireless/ath/wil6210/main.c @@ -685,7 +685,7 @@ void wil_bcast_fini_all(struct wil6210_priv *wil) int i; struct wil6210_vif *vif; - for (i = 0; i < wil->max_vifs; i++) { + for (i = 0; i < GET_MAX_VIFS(wil); i++) { vif = wil->vifs[i]; if (vif) wil_bcast_fini(vif); @@ -1483,7 +1483,7 @@ void wil_abort_scan_all_vifs(struct wil6210_priv *wil, bool sync) lockdep_assert_held(&wil->vif_mutex); - for (i = 0; i < wil->max_vifs; i++) { + for (i = 0; i < GET_MAX_VIFS(wil); i++) { struct wil6210_vif *vif = wil->vifs[i]; if (vif) @@ -1551,7 +1551,7 @@ static int wil_restore_vifs(struct wil6210_priv *wil) struct wireless_dev *wdev; int i, rc; - for (i = 0; i < wil->max_vifs; i++) { + for (i = 0; i < GET_MAX_VIFS(wil); i++) { vif = wil->vifs[i]; if (!vif) continue; @@ -1627,7 +1627,7 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw) wil_abort_scan_all_vifs(wil, false); mutex_unlock(&wil->vif_mutex); - for (i = 0; i < wil->max_vifs; i++) { + for (i = 0; i < GET_MAX_VIFS(wil); i++) { vif = wil->vifs[i]; if (vif) { cancel_work_sync(&vif->disconnect_worker); |