]> git.baikalelectronics.ru Git - kernel.git/commit
iwlwifi: prevent read outside array bounds
authorReinette Chatre <reinette.chatre@intel.com>
Thu, 13 Aug 2009 20:30:50 +0000 (13:30 -0700)
committerJohn W. Linville <linville@tuxdriver.com>
Thu, 20 Aug 2009 15:33:09 +0000 (11:33 -0400)
commit5f586c5ed462b5aba7f93d55f1ecd4d6c95726d4
tree574aabd9f6e94079697da91b1ad9c8bad865f0c6
parent1b372212e0c15f5ce5ddf8f0a200e3ee79065f14
iwlwifi: prevent read outside array bounds

With EDCA and HCCA we have 16 potential tid values. This is accommodated by
mac80211, but iwlwifi only supports EDCA. With this implementation it is
thus possible for mac80211 to request a tid that will cause iwlwifi to read
outside array bounds. A similar problem exists if traffic is received in an
unsupported category.

We add error checking to catch these situations.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/iwlwifi/iwl-agn-rs.c
drivers/net/wireless/iwlwifi/iwl-tx.c
drivers/net/wireless/iwlwifi/iwl3945-base.c