wil6210: check mid is valid

Check that the mid is valid and that it does not exceed the memory
size allocated to vifs array.

Signed-off-by: Ahmad Masri <amasri@codeaurora.org>
Signed-off-by: Maya Erez <merez@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index a1e226652b4abfff4f01fffd870e7c9616ffff98..e8d65ddb1b0a89c005656bb8847686c6c25e561a 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -465,7 +465,7 @@ static int wil_cfg80211_validate_add_iface(struct wil6210_priv *wil,
                .num_different_channels = 1,
        };
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                if (wil->vifs[i]) {
                        wdev = vif_to_wdev(wil->vifs[i]);
                        params.iftype_num[wdev->iftype]++;
@@ -486,7 +486,7 @@ static int wil_cfg80211_validate_change_iface(struct wil6210_priv *wil,
        };
        bool check_combos = false;
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                struct wil6210_vif *vif_pos = wil->vifs[i];
 
                if (vif_pos && vif != vif_pos) {
@@ -1806,7 +1806,7 @@ void wil_cfg80211_ap_recovery(struct wil6210_priv *wil)
        int rc, i;
        struct wiphy *wiphy = wil_to_wiphy(wil);
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                struct wil6210_vif *vif = wil->vifs[i];
                struct net_device *ndev;
                struct cfg80211_beacon_data bcon = {};

diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 27cb182ae423ebf130b5e1171d34874be020bab3..817762f58994dc5b03b29afaa8af8c18880647b7 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -1381,7 +1381,7 @@ static int link_show(struct seq_file *s, void *data)
                if (p->status != wil_sta_connected)
                        continue;
 
-               vif = (mid < wil->max_vifs) ? wil->vifs[mid] : NULL;
+               vif = (mid < GET_MAX_VIFS(wil)) ? wil->vifs[mid] : NULL;
                if (vif) {
                        rc = wil_cid_fill_sinfo(vif, i, sinfo);
                        if (rc)
@@ -1579,7 +1579,7 @@ __acquires(&p->tid_rx_lock) __releases(&p->tid_rx_lock)
                        break;
                }
                mid = (p->status != wil_sta_unused) ? p->mid : U8_MAX;
-               if (mid < wil->max_vifs) {
+               if (mid < GET_MAX_VIFS(wil)) {
                        struct wil6210_vif *vif = wil->vifs[mid];
 
                        if (vif->wdev.iftype == NL80211_IFTYPE_STATION &&
@@ -1645,7 +1645,7 @@ static int mids_show(struct seq_file *s, void *data)
        int i;
 
        mutex_lock(&wil->vif_mutex);
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                vif = wil->vifs[i];
 
                if (vif) {
@@ -1866,7 +1866,7 @@ static int wil_link_stats_debugfs_show(struct seq_file *s, void *data)
        /* iterate over all MIDs and show per-cid statistics. Then show the
         * global statistics
         */
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                vif = wil->vifs[i];
 
                seq_printf(s, "MID %d ", i);
@@ -1922,7 +1922,7 @@ static ssize_t wil_link_stats_write(struct file *file, const char __user *buf,
        if (rc)
                return rc;
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                vif = wil->vifs[i];
                if (!vif)
                        continue;

diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index f2432adeec3ec560ab5dcb3bafbdfdd802a0d68e..6a6bfb3b25ca1a82b67fd9601f4377521e25c7b7 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -685,7 +685,7 @@ void wil_bcast_fini_all(struct wil6210_priv *wil)
        int i;
        struct wil6210_vif *vif;
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                vif = wil->vifs[i];
                if (vif)
                        wil_bcast_fini(vif);
@@ -1483,7 +1483,7 @@ void wil_abort_scan_all_vifs(struct wil6210_priv *wil, bool sync)
 
        lockdep_assert_held(&wil->vif_mutex);
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                struct wil6210_vif *vif = wil->vifs[i];
 
                if (vif)
@@ -1551,7 +1551,7 @@ static int wil_restore_vifs(struct wil6210_priv *wil)
        struct wireless_dev *wdev;
        int i, rc;
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                vif = wil->vifs[i];
                if (!vif)
                        continue;
@@ -1627,7 +1627,7 @@ int wil_reset(struct wil6210_priv *wil, bool load_fw)
        wil_abort_scan_all_vifs(wil, false);
        mutex_unlock(&wil->vif_mutex);
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                vif = wil->vifs[i];
                if (vif) {
                        cancel_work_sync(&vif->disconnect_worker);

diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index b4e0eb1585b9871364d06855f389767d064e541a..59f041d708fe5c6c4c70ea0de4f022880dc5cbf9 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -27,7 +27,7 @@ bool wil_has_other_active_ifaces(struct wil6210_priv *wil,
        struct wil6210_vif *vif;
        struct net_device *ndev_i;
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                vif = wil->vifs[i];
                if (vif) {
                        ndev_i = vif_to_ndev(vif);
@@ -155,7 +155,7 @@ static int wil6210_netdev_poll_tx(struct napi_struct *napi, int budget)
                struct wil6210_vif *vif;
 
                if (!ring->va || !txdata->enabled ||
-                   txdata->mid >= wil->max_vifs)
+                   txdata->mid >= GET_MAX_VIFS(wil))
                        continue;
 
                vif = wil->vifs[txdata->mid];
@@ -294,7 +294,7 @@ static u8 wil_vif_find_free_mid(struct wil6210_priv *wil)
 {
        u8 i;
 
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                if (!wil->vifs[i])
                        return i;
        }
@@ -500,7 +500,7 @@ void wil_vif_remove(struct wil6210_priv *wil, u8 mid)
        bool any_active = wil_has_active_ifaces(wil, true, false);
 
        ASSERT_RTNL();
-       if (mid >= wil->max_vifs) {
+       if (mid >= GET_MAX_VIFS(wil)) {
                wil_err(wil, "invalid MID: %d\n", mid);
                return;
        }

diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index c8c6613371d1bcbd2d0a8e079053bc08b2c41d89..3b82d6cfc218b7428299a59ccb34e377de172d71 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -176,7 +176,7 @@ static void wil_remove_all_additional_vifs(struct wil6210_priv *wil)
        struct wil6210_vif *vif;
        int i;
 
-       for (i = 1; i < wil->max_vifs; i++) {
+       for (i = 1; i < GET_MAX_VIFS(wil); i++) {
                vif = wil->vifs[i];
                if (vif) {
                        wil_vif_prepare_stop(vif);

diff --git a/drivers/net/wireless/ath/wil6210/pm.c b/drivers/net/wireless/ath/wil6210/pm.c
index f307522fa26df0d02569f0780a99fa01fe64d90f..56143e7670ed93e6ead364b87d6555054ec76588 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/pm.c
+++ b/drivers/net/wireless/ath/wil6210/pm.c
@@ -26,7 +26,7 @@ static void wil_pm_wake_connected_net_queues(struct wil6210_priv *wil)
        int i;
 
        mutex_lock(&wil->vif_mutex);
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                struct wil6210_vif *vif = wil->vifs[i];
 
                if (vif && test_bit(wil_vif_fwconnected, vif->status))
@@ -40,7 +40,7 @@ static void wil_pm_stop_all_net_queues(struct wil6210_priv *wil)
        int i;
 
        mutex_lock(&wil->vif_mutex);
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                struct wil6210_vif *vif = wil->vifs[i];
 
                if (vif)
@@ -123,7 +123,7 @@ int wil_can_suspend(struct wil6210_priv *wil, bool is_runtime)
 
        /* interface is running */
        mutex_lock(&wil->vif_mutex);
-       for (i = 0; i < wil->max_vifs; i++) {
+       for (i = 0; i < GET_MAX_VIFS(wil); i++) {
                struct wil6210_vif *vif = wil->vifs[i];
 
                if (!vif)

diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 1b81f3fd59a08e76269b9c7739359f6d24601a8b..de724666857f8c94e9abc865c572e4e86dab29d2 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -1061,6 +1061,7 @@ struct wil6210_priv {
 #define vif_to_wil(v) (v->wil)
 #define vif_to_ndev(v) (v->ndev)
 #define vif_to_wdev(v) (&v->wdev)
+#define GET_MAX_VIFS(wil) min_t(int, (wil)->max_vifs, WIL_MAX_VIFS)
 
 static inline struct wil6210_vif *wdev_to_vif(struct wil6210_priv *wil,
                                              struct wireless_dev *wdev)

diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 19247c51908db37455555fc06a9e4c1c772e4a4f..c5bcb8da07c1876033a06f531bf28f1c875cf28e 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -3205,7 +3205,7 @@ static void wmi_event_handle(struct wil6210_priv *wil,
 
                if (mid == MID_BROADCAST)
                        mid = 0;
-               if (mid >= ARRAY_SIZE(wil->vifs) || mid >= wil->max_vifs) {
+               if (mid >= GET_MAX_VIFS(wil)) {
                        wil_dbg_wmi(wil, "invalid mid %d, event skipped\n",
                                    mid);
                        return;