linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Reinette Chatre <reinette.chatre@intel.com>
To: linville@tuxdriver.com
Cc: linux-wireless@vger.kernel.org,
	ipw3945-devel@lists.sourceforge.net,
	Reinette Chatre <reinette.chatre@intel.com>
Subject: [PATCH 01/13] iwlwifi: prevent read outside array bounds
Date: Thu, 13 Aug 2009 13:30:50 -0700	[thread overview]
Message-ID: <1250195462-15811-2-git-send-email-reinette.chatre@intel.com> (raw)
In-Reply-To: <1250195462-15811-1-git-send-email-reinette.chatre@intel.com>

From: Reinette Chatre <reinette.chatre@intel.com>

With EDCA and HCCA we have 16 potential tid values. This is accommodated by
mac80211, but iwlwifi only supports EDCA. With this implementation it is
thus possible for mac80211 to request a tid that will cause iwlwifi to read
outside array bounds. A similar problem exists if traffic is received in an
unsupported category.

We add error checking to catch these situations.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
---
 drivers/net/wireless/iwlwifi/iwl-agn-rs.c   |    3 +++
 drivers/net/wireless/iwlwifi/iwl-tx.c       |    5 +++++
 drivers/net/wireless/iwlwifi/iwl3945-base.c |    2 ++
 3 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 2133155..1bd7cd4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -332,6 +332,9 @@ static u8 rs_tl_add_packet(struct iwl_lq_sta *lq_data,
 	} else
 		return MAX_TID_COUNT;
 
+	if (unlikely(tid >= TID_MAX_LOAD_COUNT))
+		return MAX_TID_COUNT;
+
 	tl = &lq_data->load[tid];
 
 	curr_time -= curr_time % TID_ROUND_VALUE;
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 9b76bd4..7686fc7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -745,6 +745,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 	if (ieee80211_is_data_qos(fc)) {
 		qc = ieee80211_get_qos_ctl(hdr);
 		tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+		if (unlikely(tid >= MAX_TID_COUNT))
+			goto drop_unlock;
 		seq_number = priv->stations[sta_id].tid[tid].seq_number;
 		seq_number &= IEEE80211_SCTL_SEQ;
 		hdr->seq_ctrl = hdr->seq_ctrl &
@@ -1238,6 +1240,9 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
 		return -EINVAL;
 	}
 
+	if (unlikely(tid >= MAX_TID_COUNT))
+		return -EINVAL;
+
 	if (likely(tid < ARRAY_SIZE(default_tid_to_tx_fifo)))
 		tx_fifo_id = default_tid_to_tx_fifo[tid];
 	else
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index e617411..f339c5b 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -544,6 +544,8 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 	if (ieee80211_is_data_qos(fc)) {
 		qc = ieee80211_get_qos_ctl(hdr);
 		tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+		if (unlikely(tid >= MAX_TID_COUNT))
+			goto drop;
 		seq_number = priv->stations[sta_id].tid[tid].seq_number &
 				IEEE80211_SCTL_SEQ;
 		hdr->seq_ctrl = cpu_to_le16(seq_number) |
-- 
1.5.6.3


  reply	other threads:[~2009-08-13 20:31 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-08-13 20:30 [PATCH 0/13] iwlwifi driver updates 08/13/2009 Reinette Chatre
2009-08-13 20:30 ` Reinette Chatre [this message]
2009-08-13 20:30 ` [PATCH 02/13] iwlwifi: remove unused HT configuration entry tx_chan_width Reinette Chatre
2009-08-13 20:30 ` [PATCH 03/13] iwlwifi: include HT configuration when adding stations through rs_rate_init Reinette Chatre
2009-08-13 20:30 ` [PATCH 04/13] iwlwifi: cleanup HT40 extension channels setup Reinette Chatre
2009-08-13 20:30 ` [PATCH 05/13] iwlwifi: traverse linklist to find the valid OTP block Reinette Chatre
2009-08-13 20:30 ` [PATCH 06/13] iwlwifi: remove unused members of iwl_ht_info Reinette Chatre
2009-08-13 20:30 ` [PATCH 07/13] iwlwifi: refactor packet reception code Reinette Chatre
2009-08-13 20:30 ` [PATCH 08/13] iwlwifi: configure HT40 channels in iwl_mac_config Reinette Chatre
2009-08-13 20:30 ` [PATCH 09/13] iwlwifi: check short GI support per-station rather than globally Reinette Chatre
2009-08-13 20:30 ` [PATCH 10/13] iwlwifi: use station HT capabilities and BSS operating mode for Green-field Reinette Chatre
2009-08-13 20:31 ` [PATCH 11/13] iwlwifi: add thermal throttling support to 5150 Reinette Chatre
2009-08-13 20:31 ` [PATCH 12/13] iwlwifi: fix erroneous use of iwl_rx_packet.len as a length Reinette Chatre
2009-08-13 20:31 ` [PATCH 13/13] iwlwifi: disable PS by default Reinette Chatre

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1250195462-15811-2-git-send-email-reinette.chatre@intel.com \
    --to=reinette.chatre@intel.com \
    --cc=ipw3945-devel@lists.sourceforge.net \
    --cc=linux-wireless@vger.kernel.org \
    --cc=linville@tuxdriver.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).