| From ba3224db78034435e9ff0247277cce7c7bb1756c Mon Sep 17 00:00:00 2001 |
| From: Emmanuel Grumbach <emmanuel.grumbach@intel.com> |
| Date: Mon, 22 Jul 2019 12:47:27 +0300 |
| Subject: iwlwifi: mvm: fix an out-of-bound access |
| |
| From: Emmanuel Grumbach <emmanuel.grumbach@intel.com> |
| |
| commit ba3224db78034435e9ff0247277cce7c7bb1756c upstream. |
| |
| The index for the elements of the ACPI object we dereference |
| was static. This means that if we called the function twice |
| we wouldn't start from 3 again, but rather from the latest |
| index we reached in the previous call. |
| This was dutifully reported by KASAN. |
| |
| Fix this. |
| |
| Cc: stable@vger.kernel.org |
| Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table") |
| Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c |
| +++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c |
| @@ -778,7 +778,7 @@ static int iwl_mvm_sar_get_ewrd_table(st |
| |
| for (i = 0; i < n_profiles; i++) { |
| /* the tables start at element 3 */ |
| - static int pos = 3; |
| + int pos = 3; |
| |
| /* The EWRD profiles officially go from 2 to 4, but we |
| * save them in sar_profiles[1-3] (because we don't |
