Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

1 files changed, 8 insertions, 0 deletions

diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
index ddfc52ac1f9b..c0d323b58e73 100644
--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -312,6 +312,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
                 create_info = (struct nci_hci_create_pipe_resp *)skb->data;
                 dest_gate = create_info->dest_gate;
                 new_pipe = create_info->pipe;
+                if (new_pipe >= NCI_HCI_MAX_PIPES) {
+                        status = NCI_HCI_ANY_E_NOK;
+                        goto exit;
+                }
 
                 /* Save the new created pipe and bind with local gate,
                  * the description for skb->data[3] is destination gate id
@@ -336,6 +340,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
                         goto exit;
                 }
                 delete_info = (struct nci_hci_delete_pipe_noti *)skb->data;
+                if (delete_info->pipe >= NCI_HCI_MAX_PIPES) {
+                        status = NCI_HCI_ANY_E_NOK;
+                        goto exit;
+                }
 
                 ndev->hci_dev->pipes[delete_info->pipe].gate =
                                                 NCI_HCI_INVALID_GATE;