Skip to content

Commit 32e7037

Browse files
committed
wilc1000: add vmm_table entry validity check before accessing Txq
Add Tx VMM buffer validity check before accessing the buffer entity to avoid any access to invalid value. It's handled by moving 'vmm_table' entry check before calling wilc_wlan_txq_remove_from_head(). Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
1 parent 5051cb1 commit 32e7037

1 file changed

Lines changed: 4 additions & 4 deletions

File tree

  • drivers/net/wireless/microchip/wilc1000

drivers/net/wireless/microchip/wilc1000/wlan.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1156,14 +1156,14 @@ int wilc_wlan_handle_txq(struct wilc *wilc, u32 *txq_count)
11561156
u32 header, buffer_offset;
11571157
u8 mgmt_ptk = 0;
11581158

1159-
tqe = wilc_wlan_txq_remove_from_head(wilc, vmm_entries_ac[i]);
1160-
ac_pkt_num_to_chip[vmm_entries_ac[i]]++;
1161-
if (!tqe)
1159+
if (vmm_table[i] == 0 || vmm_entries_ac[i] >= NQUEUES)
11621160
break;
11631161

1164-
if (vmm_table[i] == 0)
1162+
tqe = wilc_wlan_txq_remove_from_head(wilc, vmm_entries_ac[i]);
1163+
if (!tqe)
11651164
break;
11661165

1166+
ac_pkt_num_to_chip[vmm_entries_ac[i]]++;
11671167
vif = tqe->vif;
11681168
le32_to_cpus(&vmm_table[i]);
11691169
vmm_sz = FIELD_GET(WILC_VMM_BUFFER_SIZE, vmm_table[i]);

0 commit comments

Comments
 (0)