aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-07-25 23:34:31 +0200
committerJohn W. Linville <linville@tuxdriver.com>2009-07-27 15:19:37 -0400
commit082e708acc50a5b625b9bde0bb1af90dfdbd1942 (patch)
tree71fcce74adf2a0c53057942eedbb15bf24b96e9e
parent008749fc9917b799c469478141ddd1a4c81d06ca (diff)
downloadkernel_samsung_aries-082e708acc50a5b625b9bde0bb1af90dfdbd1942.zip
kernel_samsung_aries-082e708acc50a5b625b9bde0bb1af90dfdbd1942.tar.gz
kernel_samsung_aries-082e708acc50a5b625b9bde0bb1af90dfdbd1942.tar.bz2
iwlwifi: Read outside array bounds
tid is bounded (above) by the size of default_tid_to_tx_fifo (17 elements), but the size of priv->stations[].tid[] is MAX_TID_COUNT (9) elements. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--drivers/net/wireless/iwlwifi/iwl-tx.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 5febb31..2e89040 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1171,6 +1171,8 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
IWL_ERR(priv, "Start AGG on invalid station\n");
return -ENXIO;
}
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");