Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9dc5060 authored by Eyal Shapira's avatar Eyal Shapira Committed by Emmanuel Grumbach
Browse files

iwlwifi: mvm: fix out of bounds access to tid_to_mac80211_ac 



When tid_tspec was set to IWL_TID_NON_QOS (8) this led to an
out of bounds access to the tid_to_mac80211_ac array whose size
is 7. Fix this.

Signed-off-by: default avatarEyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
parent c93edc63

drivers/net/wireless/iwlwifi/mvm/tx.c

+6 −2
Original line number Diff line number Diff line
@@ -108,8 +108,12 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb, 
			tx_flags &= ~TX_CMD_FLG_SEQ_CTL;

	}



	/* tid_tspec will default to 0 = BE when QOS isn't enabled */

	/* Default to 0 (BE) when tid_spec is set to IWL_TID_NON_QOS */

	if (tx_cmd->tid_tspec < IWL_MAX_TID_COUNT)

		ac = tid_to_mac80211_ac[tx_cmd->tid_tspec];

	else

		ac = tid_to_mac80211_ac[0];



	tx_flags |= iwl_mvm_bt_coex_tx_prio(mvm, hdr, info, ac) <<

			TX_CMD_FLG_BT_PRIO_POS;