Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0b0f934e authored by Emmanuel Grumbach's avatar Emmanuel Grumbach Committed by Luca Coelho
Browse files

iwlwifi: dvm: prevent an out of bounds access 



iwlagn_check_ratid_empty takes the tid as a parameter, but
it doesn't check that it is not IWL_TID_NON_QOS.
Since IWL_TID_NON_QOS = 8 and iwl_priv::tid_data is an array
with 8 entries, accessing iwl_priv::tid_data[IWL_TID_NON_QOS]
is a bad idea.
This happened in iwlagn_rx_reply_tx. Since
iwlagn_check_ratid_empty is relevant only to check whether
we can open A-MPDU, this flow is irrelevant if tid is
IWL_TID_NON_QOS. Call iwlagn_check_ratid_empty only inside
the
	if (tid != IWL_TID_NON_QOS)

a few lines earlier in the function.

Cc: <stable@vger.kernel.org>
Reported-by: default avatarSeraphime Kirkovski <kirkseraph@gmail.com>
Tested-by: default avatarSeraphime Kirkovski <kirkseraph@gmail.com>
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 271612d7

drivers/net/wireless/intel/iwlwifi/dvm/tx.c

+1 −1
Original line number Diff line number Diff line
@@ -1189,11 +1189,11 @@ void iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb) 
				next_reclaimed;

			IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",

						  next_reclaimed);

			iwlagn_check_ratid_empty(priv, sta_id, tid);

		}



		iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);



		iwlagn_check_ratid_empty(priv, sta_id, tid);

		freed = 0;



		/* process frames */