diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-05-10 23:03:47 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-05-10 23:03:47 -0700 |
| commit | 1b96a3f87a0049804b396407b462d5940b3d2eaa (patch) | |
| tree | 346f2b1133d989fb5db15a1a84bea3ad3e79a059 | |
| parent | 04433d45e28d18eb90513e0a29b525d8370d7ab9 (diff) | |
| parent | a51470bcaee22523d6a0c02b91e2334cf29a26c3 (diff) | |
Merge "wil6210: fix array out of bounds access in pmc"
| -rw-r--r-- | drivers/net/wireless/ath/wil6210/pmc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath/wil6210/pmc.c b/drivers/net/wireless/ath/wil6210/pmc.c index b067fdf086d4..2e301b6b32a9 100644 --- a/drivers/net/wireless/ath/wil6210/pmc.c +++ b/drivers/net/wireless/ath/wil6210/pmc.c @@ -200,7 +200,7 @@ void wil_pmc_alloc(struct wil6210_priv *wil, release_pmc_skbs: wil_err(wil, "exit on error: Releasing skbs...\n"); - for (i = 0; pmc->descriptors[i].va && i < num_descriptors; i++) { + for (i = 0; i < num_descriptors && pmc->descriptors[i].va; i++) { dma_free_coherent(dev, descriptor_size, pmc->descriptors[i].va, @@ -283,7 +283,7 @@ void wil_pmc_free(struct wil6210_priv *wil, int send_pmc_cmd) int i; for (i = 0; - pmc->descriptors[i].va && i < pmc->num_descriptors; i++) { + i < pmc->num_descriptors && pmc->descriptors[i].va; i++) { dma_free_coherent(dev, pmc->descriptor_size, pmc->descriptors[i].va, |