Commit 69a871b4 authored Dec 30, 2019 by Alexei Avshalom Lazar

wil6210: Validate return value of cfg80211_classify8021d()



Driver assumes that the return value of cfg80211_classify8021d()
doesn't exceed wil_1d_to_queue array size.
Add explicit check before accessing the wil_1d_to_queue array.

Change-Id: Ieadeb20c3056a9180cc5092eca07e9bdb7cc65bf
Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>

parent 576ac265

drivers/net/wireless/ath/wil6210/netdev.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -127,6 +127,9 @@ static u16 wil_select_queue(struct net_device *ndev,
		else if (skb->priority == 0 \|\| skb->priority > 7)
		skb->priority = cfg80211_classify8021d(skb, NULL);

		if (unlikely(skb->priority >= ARRAY_SIZE(wil_1d_to_queue)))
		skb->priority = 0;

		qid = wil_1d_to_queue[skb->priority];

		wil_dbg_txrx(wil, "select queue for priority %d -> queue %d\n",