Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 723d11a4 authored by Johannes Berg's avatar Johannes Berg Committed by Luca Coelho
Browse files

iwlwifi: mvm: make RSS RX more robust 



If the firmware ever decides to send any new/more notifications
to the RSS queues, the driver would currently try to interpret
those as REPLY_RX_MPDU_CMD and, if the notification was small,
access invalid memory.

Prevent that by checking for REPLY_RX_MPDU_CMD explicitly which
allows ignoring unexpected notifications.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 612da1ef

drivers/net/wireless/intel/iwlwifi/mvm/ops.c

+1 −1
Original line number Diff line number Diff line
@@ -1672,7 +1672,7 @@ static void iwl_mvm_rx_mq_rss(struct iwl_op_mode *op_mode, 
	else if (unlikely(pkt->hdr.cmd == RX_QUEUES_NOTIFICATION &&

			  pkt->hdr.group_id == DATA_PATH_GROUP))

		iwl_mvm_rx_queue_notif(mvm, rxb, queue);

	else

	else if (likely(pkt->hdr.cmd == REPLY_RX_MPDU_CMD))

		iwl_mvm_rx_mpdu_mq(mvm, napi, rxb, queue);

}