All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lee Jones <lee.jones@linaro.org>
To: stable@vger.kernel.org
Cc: Alexei Avshalom Lazar <ailizaro@codeaurora.org>,
	Maya Erez <merez@codeaurora.org>,
	Kalle Valo <kvalo@codeaurora.org>,
	Lee Jones <lee.jones@linaro.org>
Subject: [PATCH 4.19 07/13] wil6210: add general initialization/size checks
Date: Fri,  3 Apr 2020 13:18:53 +0100	[thread overview]
Message-ID: <20200403121859.901838-8-lee.jones@linaro.org> (raw)
In-Reply-To: <20200403121859.901838-1-lee.jones@linaro.org>

From: Alexei Avshalom Lazar <ailizaro@codeaurora.org>

[ Upstream commit ac0e541ab2f2951845acee784ef487be40fb4c77 ]

Initialize unset variable, and verify that mid is valid.

Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
---
 drivers/net/wireless/ath/wil6210/debugfs.c | 2 ++
 drivers/net/wireless/ath/wil6210/wmi.c     | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 44296c0159252..acd95ca0430b9 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -991,6 +991,8 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
 	int rc;
 	void *frame;
 
+	memset(&params, 0, sizeof(params));
+
 	if (!len)
 		return -EINVAL;
 
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 8a603432f5317..3928b13ae0266 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -2802,7 +2802,7 @@ static void wmi_event_handle(struct wil6210_priv *wil,
 
 		if (mid == MID_BROADCAST)
 			mid = 0;
-		if (mid >= wil->max_vifs) {
+		if (mid >= ARRAY_SIZE(wil->vifs) || mid >= wil->max_vifs) {
 			wil_dbg_wmi(wil, "invalid mid %d, event skipped\n",
 				    mid);
 			return;
-- 
2.25.1


  parent reply	other threads:[~2020-04-03 12:18 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-03 12:18 [PATCH 4.19 00/13] Backported fixes taken from Sony's Vendor tree Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 01/13] clk: qcom: rcg: Return failure for RCG update Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 02/13] drm/msm: stop abusing dma_map/unmap for cache Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 03/13] arm64: Fix size of __early_cpu_boot_status Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 04/13] drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read() Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 05/13] wil6210: check rx_buff_mgmt before accessing it Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 06/13] wil6210: ignore HALP ICR if already handled Lee Jones
2020-04-03 12:18 ` Lee Jones [this message]
2020-04-03 12:18 ` [PATCH 4.19 08/13] wil6210: make sure Rx ring sizes are correlated Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 09/13] rpmsg: glink: Remove chunk size word align warning Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 10/13] wil6210: remove reset file from debugfs Lee Jones
2020-04-11 11:47   ` Greg KH
2020-04-14  7:42     ` Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 11/13] perf/core: Reattach a misplaced comment Lee Jones
2020-04-03 12:26   ` Greg KH
2020-04-03 12:52     ` Lee Jones
2020-04-03 13:23       ` Alexander Shishkin
2020-04-11 11:49         ` Greg KH
2020-04-14  7:37           ` Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 12/13] mm/vmalloc.c: move 'area->pages' after if statement Lee Jones
2020-04-03 12:18 ` [PATCH 4.19 13/13] usb: dwc3: don't set gadget->is_otg flag Lee Jones
2020-04-20 11:24 ` [PATCH 4.19 00/13] Backported fixes taken from Sony's Vendor tree Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200403121859.901838-8-lee.jones@linaro.org \
    --to=lee.jones@linaro.org \
    --cc=ailizaro@codeaurora.org \
    --cc=kvalo@codeaurora.org \
    --cc=merez@codeaurora.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.