Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 56214749 authored by Liad Kaufman's avatar Liad Kaufman Committed by Luca Coelho
Browse files

iwlwifi: mvm: fix reserved txq freeing 



If a TXQ's marking as a reserved queue is removed,
when removing the STA the driver might try to access
out of bounds memory. Make sure the reserved queue
is freed only if it is still reserved.

Signed-off-by: default avatarLiad Kaufman <liad.kaufman@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 341ca402

drivers/net/wireless/intel/iwlwifi/mvm/sta.c

+6 −3
Original line number Diff line number Diff line
@@ -1494,12 +1494,15 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm, 
		ret = iwl_mvm_drain_sta(mvm, mvm_sta, false);



		/* If DQA is supported - the queues can be disabled now */

		if (iwl_mvm_is_dqa_supported(mvm)) {

		if (iwl_mvm_is_dqa_supported(mvm))

			iwl_mvm_disable_sta_queues(mvm, vif, mvm_sta);



		/* If there is a TXQ still marked as reserved - free it */

		if (iwl_mvm_is_dqa_supported(mvm) &&

		    mvm_sta->reserved_queue != IEEE80211_INVAL_HW_QUEUE) {

			u8 reserved_txq = mvm_sta->reserved_queue;

			enum iwl_mvm_queue_status *status;



			iwl_mvm_disable_sta_queues(mvm, vif, mvm_sta);



			/*

			 * If no traffic has gone through the reserved TXQ - it

			 * is still marked as IWL_MVM_QUEUE_RESERVED, and