iwlwifi: don't allow the FW to return invalid ch indices
authorArik Nemtsov <arik@wizery.com>
Sun, 1 Mar 2015 16:24:57 +0000 (18:24 +0200)
committerEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Thu, 12 Mar 2015 07:57:39 +0000 (09:57 +0200)
If the FW returns an invalid channels count in response to an MCC request,
make sure we don't reference invalid indices in the channels array.

Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
drivers/net/wireless/iwlwifi/iwl-nvm-parse.c

index b372105604a06e8d58beaa2a6a34bf795eee1e5d..774637746427ccce154a236b186fa7c79ffdc514 100644 (file)
@@ -743,10 +743,15 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
        int center_freq, prev_center_freq = 0;
        int valid_rules = 0;
        bool new_rule;
+       int max_num_ch = cfg->device_family == IWL_DEVICE_FAMILY_8000 ?
+                        IWL_NUM_CHANNELS_FAMILY_8000 : IWL_NUM_CHANNELS;
 
        if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
                return ERR_PTR(-EINVAL);
 
+       if (WARN_ON(num_of_ch > max_num_ch))
+               num_of_ch = max_num_ch;
+
        IWL_DEBUG_DEV(dev, IWL_DL_LAR, "building regdom for %d channels\n",
                      num_of_ch);