brcmfmac: add valid core index check in related functions

Perform a valid check for core index to avoid illegal address access.

Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Franky Lin <frankyl@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index 023ddcb885de..2096a14ef1fb 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -137,6 +137,8 @@ brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
         u8 idx;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return false;
 
         regdata = brcmf_sdio_regrl(sdiodev,
                                    CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
@@ -155,6 +157,8 @@ brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
         bool ret;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return false;
 
         regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
                                    NULL);
@@ -262,6 +266,8 @@ brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
         u32 regdata;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /* if core is already in reset, just return */
         regdata = brcmf_sdio_regrl(sdiodev,
@@ -305,6 +311,8 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
         u8 idx;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /*
          * Must do the disable sequence first to work for
@@ -369,6 +377,8 @@ brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev,
         u32 regdata;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
 
         /* must disable first to work for arbitrary current core state */
         brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, core_bits);