diff options
| author | Reinette Chatre <reinette.chatre@intel.com> | 2009-08-13 13:30:50 -0700 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-08-20 11:33:09 -0400 |
| commit | e6a6cf4c42e0dc3541a63b5f0f88299f982d6704 (patch) | |
| tree | 574aabd9f6e94079697da91b1ad9c8bad865f0c6 /drivers/net/wireless/iwlwifi/iwl-agn-rs.c | |
| parent | a8b875e7dc80ff442698d8cf4f45ccce400a6a66 (diff) | |
| download | kernel-crypto-e6a6cf4c42e0dc3541a63b5f0f88299f982d6704.tar.gz kernel-crypto-e6a6cf4c42e0dc3541a63b5f0f88299f982d6704.tar.xz kernel-crypto-e6a6cf4c42e0dc3541a63b5f0f88299f982d6704.zip | |
iwlwifi: prevent read outside array bounds
With EDCA and HCCA we have 16 potential tid values. This is accommodated by
mac80211, but iwlwifi only supports EDCA. With this implementation it is
thus possible for mac80211 to request a tid that will cause iwlwifi to read
outside array bounds. A similar problem exists if traffic is received in an
unsupported category.
We add error checking to catch these situations.
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/iwlwifi/iwl-agn-rs.c')
| -rw-r--r-- | drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c index 21331552ff2..1bd7cd4dd80 100644 --- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c @@ -332,6 +332,9 @@ static u8 rs_tl_add_packet(struct iwl_lq_sta *lq_data, } else return MAX_TID_COUNT; + if (unlikely(tid >= TID_MAX_LOAD_COUNT)) + return MAX_TID_COUNT; + tl = &lq_data->load[tid]; curr_time -= curr_time % TID_ROUND_VALUE; |