From fb3c06cfda0db68f6082f05c43d63c1fb1761af0 Mon Sep 17 00:00:00 2001
From: Luca Coelho <luciano.coelho@intel.com>
Date: Mon, 23 Dec 2019 13:00:59 +0200
Subject: [PATCH] iwlwifi: fw: make pos static in iwl_sar_get_ewrd_table() loop
Git-commit: fb3c06cfda0db68f6082f05c43d63c1fb1761af0
References: git-fixes
Patch-mainline: v5.5

In the for loop where we are supposed to go through the entire table,
we are using a non-static local to keep the pos index.  This makes
each iteration start with 3, so we always access the first item on the
table.  Fix this by moving the variable outside of the loo so it
doesn't lose its value at every iteration.

Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Fixes: ba3224db7803 ("iwlwifi: mvm: fix an out-of-bound access")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -690,7 +690,7 @@ static int iwl_mvm_sar_get_ewrd_table(st
 {
 	union acpi_object *wifi_pkg, *data;
 	bool enabled;
-	int i, n_profiles, ret;
+	int i, n_profiles, ret, pos;
 
 	data = iwl_acpi_get_object(mvm->dev, ACPI_EWRD_METHOD);
 	if (IS_ERR(data))
@@ -722,10 +722,9 @@ static int iwl_mvm_sar_get_ewrd_table(st
 		goto out_free;
 	}
 
+	/* the tables start at element 3 */
+	pos = 3;
 	for (i = 0; i < n_profiles; i++) {
-		/* the tables start at element 3 */
-		int pos = 3;
-
 		/* The EWRD profiles officially go from 2 to 4, but we
 		 * save them in sar_profiles[1-3] (because we don't
 		 * have profile 0).  So in the array we start from 1.