From: zhangyue <zhangyue1@kylinos.cn>
Date: Wed, 8 Dec 2021 09:53:41 +0000 (+0800)
Subject: rsi: fix array out of bound
X-Git-Tag: v6.6.17~8491^2~165^2~4
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=4d375c2e51d5b3227683e3a9a198a2f003959c76;p=platform%2Fkernel%2Flinux-rpi.git

rsi: fix array out of bound

Limit the max of 'ii'. If 'ii' greater than or
equal to 'RSI_MAX_VIFS', the array 'adapter->vifs'
may be out of bound

Signed-off-by: zhangyue <zhangyue1@kylinos.cn>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20211208095341.47777-1-zhangyue1@kylinos.cn
---

diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index e70c1c7f..913e11f 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -1108,6 +1108,9 @@ static int rsi_mac80211_ampdu_action(struct ieee80211_hw *hw,
 			break;
 	}
 
+	if (ii >= RSI_MAX_VIFS)
+		return status;
+
 	mutex_lock(&common->mutex);
 
 	if (ssn != NULL)