mac80211: sanity check CW_min/CW_max towards driver

There's no reason to ever set invalid CW_min/CW_max to the
drivers, we should catch it in higher layers. However, the
consequences of setting it wrong can be quite severe, so
double-check at a low level and error out for invalid data.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 1bbb0790264f..3df28e0fa045 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -631,6 +631,12 @@ static inline int drv_conf_tx(struct ieee80211_local *local,
         if (!check_sdata_in_driver(sdata))
                 return -EIO;
 
+        if (WARN_ONCE(params->cw_min == 0 ||
+                      params->cw_min > params->cw_max,
+                      "%s: invalid CW_min/CW_max: %d/%d\n",
+                      sdata->name, params->cw_min, params->cw_max))
+                return -EINVAL;
+
         trace_drv_conf_tx(local, sdata, ac, params);
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, &sdata->vif,