aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
diff options
context:
space:
mode:
authorReinette Chatre <reinette.chatre@intel.com>2009-08-13 16:30:50 -0400
committerJohn W. Linville <linville@tuxdriver.com>2009-08-20 11:33:09 -0400
commite6a6cf4c42e0dc3541a63b5f0f88299f982d6704 (patch)
tree574aabd9f6e94079697da91b1ad9c8bad865f0c6 /drivers/net/wireless/iwlwifi/iwl-agn-rs.c
parenta8b875e7dc80ff442698d8cf4f45ccce400a6a66 (diff)
iwlwifi: prevent read outside array bounds
With EDCA and HCCA we have 16 potential tid values. This is accommodated by mac80211, but iwlwifi only supports EDCA. With this implementation it is thus possible for mac80211 to request a tid that will cause iwlwifi to read outside array bounds. A similar problem exists if traffic is received in an unsupported category. We add error checking to catch these situations. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/iwlwifi/iwl-agn-rs.c')
-rw-r--r--drivers/net/wireless/iwlwifi/iwl-agn-rs.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 21331552ff2c..1bd7cd4dd809 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -332,6 +332,9 @@ static u8 rs_tl_add_packet(struct iwl_lq_sta *lq_data,
332 } else 332 } else
333 return MAX_TID_COUNT; 333 return MAX_TID_COUNT;
334 334
335 if (unlikely(tid >= TID_MAX_LOAD_COUNT))
336 return MAX_TID_COUNT;
337
335 tl = &lq_data->load[tid]; 338 tl = &lq_data->load[tid];
336 339
337 curr_time -= curr_time % TID_ROUND_VALUE; 340 curr_time -= curr_time % TID_ROUND_VALUE;