From 76dd61d2c57e881020cd2ea61994bf2dc8aefd84 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 18 Jun 2018 09:53:36 +0200
Subject: [PATCH] iwlwifi: pcie gen2: check iwl_pcie_gen2_set_tb() return value
Git-commit: 76dd61d2c57e881020cd2ea61994bf2dc8aefd84
Patch-mainline: v4.20-rc1
References: bsc#1051510
If we use the iwl_pcie_gen2_set_tb() return value for BIT(),
we should validate that it's not going to be negative, so do
the check and bail out if we hit an error. We shouldn't, as
we check if it'll fit beforehand, but better be safe.
Fixes: ab6c644539e9 ("iwlwifi: pcie: copy TX functions to new transport")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -460,6 +460,8 @@ struct iwl_tfh_tfd *iwl_pcie_gen2_build_
goto out_err;
tb_idx = iwl_pcie_gen2_set_tb(trans, tfd, tb_phys,
skb_frag_size(frag));
+ if (tb_idx < 0)
+ goto out_err;
out_meta->tbs |= BIT(tb_idx);
}