From fb3c06cfda0db68f6082f05c43d63c1fb1761af0 Mon Sep 17 00:00:00 2001

From: Luca Coelho <luciano.coelho@intel.com>

Date: Mon, 23 Dec 2019 13:00:59 +0200

Subject: [PATCH] iwlwifi: fw: make pos static in iwl_sar_get_ewrd_table() loop

Git-commit: fb3c06cfda0db68f6082f05c43d63c1fb1761af0

References: git-fixes

Patch-mainline: v5.5

In the for loop where we are supposed to go through the entire table,

we are using a non-static local to keep the pos index.  This makes

each iteration start with 3, so we always access the first item on the

table.  Fix this by moving the variable outside of the loo so it

doesn't lose its value at every iteration.

Reported-by: Colin Ian King <colin.king@canonical.com>

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Fixes: ba3224db7803 ("iwlwifi: mvm: fix an out-of-bound access")

Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

Signed-off-by: Oliver Neukum <oneukum@suse.com>

---

 drivers/net/wireless/intel/iwlwifi/mvm/fw.c |    7 +++----

 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c

+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c

@@ -690,7 +690,7 @@ static int iwl_mvm_sar_get_ewrd_table(st

 {

 	union acpi_object *wifi_pkg, *data;

 	bool enabled;

-	int i, n_profiles, ret;

+	int i, n_profiles, ret, pos;

 	data = iwl_acpi_get_object(mvm->dev, ACPI_EWRD_METHOD);

 	if (IS_ERR(data))

@@ -722,10 +722,9 @@ static int iwl_mvm_sar_get_ewrd_table(st

 		goto out_free;

 	}

+	/* the tables start at element 3 */

+	pos = 3;

 	for (i = 0; i < n_profiles; i++) {

-		/* the tables start at element 3 */

-		int pos = 3;

-

 		/* The EWRD profiles officially go from 2 to 4, but we

 		 * save them in sar_profiles[1-3] (because we don't

 		 * have profile 0).  So in the array we start from 1.