| From d00af64307a504a9e481e7046c7e5a6594707c8a Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 23 Aug 2018 14:47:13 +0300 |
| Subject: wil6210: fix invalid memory access for rx_buff_mgmt debugfs |
| |
| From: Dedy Lansky <dlansky@codeaurora.org> |
| |
| [ Upstream commit 4405b632e3da839defec966e4b0be44d0c5e3102 ] |
| |
| Check rx_buff_mgmt is allocated before accessing its internal fields. |
| |
| Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> |
| Signed-off-by: Maya Erez <merez@codeaurora.org> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/ath/wil6210/debugfs.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c |
| index 51c3330bc316f..ceace95b1595c 100644 |
| --- a/drivers/net/wireless/ath/wil6210/debugfs.c |
| +++ b/drivers/net/wireless/ath/wil6210/debugfs.c |
| @@ -1263,6 +1263,9 @@ static int wil_rx_buff_mgmt_debugfs_show(struct seq_file *s, void *data) |
| int num_active; |
| int num_free; |
| |
| + if (!rbm->buff_arr) |
| + return -EINVAL; |
| + |
| seq_printf(s, " size = %zu\n", rbm->size); |
| seq_printf(s, " free_list_empty_cnt = %lu\n", |
| rbm->free_list_empty_cnt); |
| -- |
| 2.20.1 |
| |
