From: Luca Coelho <luca@coelho.fi>
To: kvalo@codeaurora.org
Cc: linux-wireless@vger.kernel.org,
Mordechay Goodstein <mordechay.goodstein@intel.com>,
Luca Coelho <luciano.coelho@intel.com>
Subject: [PATCH 13/16] iwlwifi: mvm: avoid possible access out of array.
Date: Mon, 21 Jan 2019 09:50:23 +0200 [thread overview]
Message-ID: <20190121075026.25059-14-luca@coelho.fi> (raw)
In-Reply-To: <20190121075026.25059-1-luca@coelho.fi>
From: Mordechay Goodstein <mordechay.goodstein@intel.com>
The value in txq_id can be out of array scope,
validate it before accessing the array.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 09f294c466da..5f42897dcd55 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2702,7 +2702,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
struct iwl_mvm_tid_data *tid_data;
u16 normalized_ssn;
- int txq_id;
+ u16 txq_id;
int ret;
if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
@@ -2744,17 +2744,24 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
*/
txq_id = mvmsta->tid_data[tid].txq_id;
if (txq_id == IWL_MVM_INVALID_QUEUE) {
- txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
- IWL_MVM_DQA_MIN_DATA_QUEUE,
- IWL_MVM_DQA_MAX_DATA_QUEUE);
- if (txq_id < 0) {
- ret = txq_id;
+ ret = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
+ IWL_MVM_DQA_MIN_DATA_QUEUE,
+ IWL_MVM_DQA_MAX_DATA_QUEUE);
+ if (ret < 0) {
IWL_ERR(mvm, "Failed to allocate agg queue\n");
goto out;
}
+ txq_id = ret;
+
/* TXQ hasn't yet been enabled, so mark it only as reserved */
mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED;
+ } else if (WARN_ON(txq_id >= IWL_MAX_HW_QUEUES)) {
+ ret = -ENXIO;
+ IWL_ERR(mvm, "tid_id %d out of range (0, %d)!\n",
+ tid, IWL_MAX_HW_QUEUES - 1);
+ goto out;
+
} else if (unlikely(mvm->queue_info[txq_id].status ==
IWL_MVM_QUEUE_SHARED)) {
ret = -ENXIO;
--
2.20.1
next prev parent reply other threads:[~2019-01-21 7:51 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-21 7:50 [PATCH 00/16] iwlwifi: updates intended for v4.21 2019-01-21 Luca Coelho
2019-01-21 7:50 ` [PATCH 01/16] iwlwifi: mvm: support mac80211 AMSDU Luca Coelho
2019-01-22 12:53 ` Kalle Valo
2019-01-23 8:25 ` [PATCH v2] " Luca Coelho
2019-01-21 7:50 ` [PATCH 02/16] iwlwifi: mvm: fix values in the table example Luca Coelho
2019-01-21 7:50 ` [PATCH 03/16] iwlwifi: use kmemdup in iwl_parse_nvm_mcc_info() Luca Coelho
2019-01-21 7:50 ` [PATCH 04/16] iwlwifi: fix spelling mistake "registrating" -> "registering" Luca Coelho
2019-01-21 7:50 ` [PATCH 05/16] iwlwifi: mvm: bring back mvm GSO code Luca Coelho
2019-01-21 7:50 ` [PATCH 06/16] iwlwifi: mvm: Flush transmit queues on P2P Device ROC done Luca Coelho
2019-01-21 7:50 ` [PATCH 07/16] iwlwifi: mvm: Set Tx rate and flags when there is not station Luca Coelho
2019-01-21 7:50 ` [PATCH 08/16] iwlwifi: mvm: Do not set RTS/CTS protection for P2P Device MAC Luca Coelho
2019-01-21 7:50 ` [PATCH 09/16] iwlwifi: update hcmds documentation Luca Coelho
2019-01-21 7:50 ` [PATCH 10/16] iwlwifi: mvm: make num_active_macs unsigned Luca Coelho
2019-01-21 7:50 ` [PATCH 11/16] iwlwifi: tighten boundary checks Luca Coelho
2019-01-21 7:50 ` [PATCH 12/16] iwlwifi: memcpy from dev_cmd and not dev_cmd->hdr Luca Coelho
2019-01-21 7:50 ` Luca Coelho [this message]
2019-01-21 7:50 ` [PATCH 14/16] iwlwifi: avoid access out of memory allocated Luca Coelho
2019-01-21 7:50 ` [PATCH 15/16] iwlwifi: fw api: remove unused/deprecated filter status Luca Coelho
2019-01-21 7:50 ` [PATCH 16/16] iwlwifi: fw api: document WoWLAN patterns command Luca Coelho
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190121075026.25059-14-luca@coelho.fi \
--to=luca@coelho.fi \
--cc=kvalo@codeaurora.org \
--cc=linux-wireless@vger.kernel.org \
--cc=luciano.coelho@intel.com \
--cc=mordechay.goodstein@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).