lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 074/343] iwlwifi: mvm: avoid possible access out of array.
    Date
    From: Mordechay Goodstein <mordechay.goodstein@intel.com>

    [ Upstream commit b0d795a9ae558209656b18930c2b4def5f8fdfb8 ]

    The value in txq_id can be out of array scope,
    validate it before accessing the array.

    Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
    Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 19 +++++++++++++------
    1 file changed, 13 insertions(+), 6 deletions(-)

    diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
    index 0cfdbaa2af3a7..684c0f65a0528 100644
    --- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
    +++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
    @@ -2417,7 +2417,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
    struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
    struct iwl_mvm_tid_data *tid_data;
    u16 normalized_ssn;
    - int txq_id;
    + u16 txq_id;
    int ret;

    if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
    @@ -2452,17 +2452,24 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
    */
    txq_id = mvmsta->tid_data[tid].txq_id;
    if (txq_id == IWL_MVM_INVALID_QUEUE) {
    - txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
    - IWL_MVM_DQA_MIN_DATA_QUEUE,
    - IWL_MVM_DQA_MAX_DATA_QUEUE);
    - if (txq_id < 0) {
    - ret = txq_id;
    + ret = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
    + IWL_MVM_DQA_MIN_DATA_QUEUE,
    + IWL_MVM_DQA_MAX_DATA_QUEUE);
    + if (ret < 0) {
    IWL_ERR(mvm, "Failed to allocate agg queue\n");
    goto release_locks;
    }

    + txq_id = ret;
    +
    /* TXQ hasn't yet been enabled, so mark it only as reserved */
    mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED;
    + } else if (WARN_ON(txq_id >= IWL_MAX_HW_QUEUES)) {
    + ret = -ENXIO;
    + IWL_ERR(mvm, "tid_id %d out of range (0, %d)!\n",
    + tid, IWL_MAX_HW_QUEUES - 1);
    + goto out;
    +
    } else if (unlikely(mvm->queue_info[txq_id].status ==
    IWL_MVM_QUEUE_SHARED)) {
    ret = -ENXIO;
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 10:48    [W:4.011 / U:0.752 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site