Commit 3fafdd7c authored by David Vrabel's avatar David Vrabel
Browse files

uwb: handle radio controller events with out-of-range IDs correctly 



If a radio controller event has an ID that's just out of range don't
read beyond the end of uwbd's event arrays.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarDavid Vrabel <david.vrabel@csr.com>
parent 7c0a57d5

drivers/uwb/uwbd.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -187,12 +187,12 @@ int uwbd_event_handle_urc(struct uwb_event *evt) 
	event = le16_to_cpu(evt->notif.rceb->wEvent);

	event = le16_to_cpu(evt->notif.rceb->wEvent);

	context = evt->notif.rceb->bEventContext;

	context = evt->notif.rceb->bEventContext;





	if (type > ARRAY_SIZE(uwbd_urc_evt_type_handlers))

	if (type >= ARRAY_SIZE(uwbd_urc_evt_type_handlers))

		goto out;

		goto out;

	type_table = &uwbd_urc_evt_type_handlers[type];

	type_table = &uwbd_urc_evt_type_handlers[type];

	if (type_table->uwbd_events == NULL)

	if (type_table->uwbd_events == NULL)

		goto out;

		goto out;

	if (event > type_table->size)

	if (event >= type_table->size)

		goto out;

		goto out;

	handler = type_table->uwbd_events[event].handler;

	handler = type_table->uwbd_events[event].handler;

	if (handler == NULL)

	if (handler == NULL)