archive mirror
 help / color / mirror / Atom feed
From: Luca Coelho <>
	Emmanuel Grumbach <>,, Luca Coelho <>
Subject: [PATCH 1/7] iwlwifi: dvm: prevent an out of bounds access
Date: Wed,  5 Jul 2017 09:05:33 +0300	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: Emmanuel Grumbach <>

iwlagn_check_ratid_empty takes the tid as a parameter, but
it doesn't check that it is not IWL_TID_NON_QOS.
Since IWL_TID_NON_QOS = 8 and iwl_priv::tid_data is an array
with 8 entries, accessing iwl_priv::tid_data[IWL_TID_NON_QOS]
is a bad idea.
This happened in iwlagn_rx_reply_tx. Since
iwlagn_check_ratid_empty is relevant only to check whether
we can open A-MPDU, this flow is irrelevant if tid is
IWL_TID_NON_QOS. Call iwlagn_check_ratid_empty only inside
	if (tid != IWL_TID_NON_QOS)

a few lines earlier in the function.

Cc: <>
Reported-by: Seraphime Kirkovski <>
Tested-by: Seraphime Kirkovski <>
Signed-off-by: Emmanuel Grumbach <>
Signed-off-by: Luca Coelho <>
 drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
index adaa2f0097cc..fb40ddfced99 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
@@ -1189,11 +1189,11 @@ void iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)
 			IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+			iwlagn_check_ratid_empty(priv, sta_id, tid);
 		iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
-		iwlagn_check_ratid_empty(priv, sta_id, tid);
 		freed = 0;
 		/* process frames */

  reply	other threads:[~2017-07-05  6:05 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-07-05  6:05 [PATCH 0/7] iwlwifi: some fixes intended for 4.13 Luca Coelho
2017-07-05  6:05 ` Luca Coelho [this message]
2017-07-05  6:05 ` [PATCH 2/7] iwlwifi: pcie: fix unused txq NULL pointer dereference Luca Coelho
2017-07-05  6:05 ` [PATCH 3/7] iwlwifi: mvm: fix a NULL pointer dereference of error in recovery Luca Coelho
2017-07-05  6:05 ` [PATCH 4/7] iwlwifi: missing error code in iwl_trans_pcie_alloc() Luca Coelho
2017-07-05  6:05 ` [PATCH 5/7] iwlwifi: fix tracing when tx only is enabled Luca Coelho
2017-07-05  6:05 ` [PATCH 6/7] iwlwifi: mvm: handle IBSS probe_queue in a few missing places Luca Coelho
2017-07-05  6:05 ` [PATCH 7/7] iwlwifi: mvm: defer setting IWL_MVM_STATUS_IN_HW_RESTART Luca Coelho

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).