iwlwifi: prevent read outside array bounds
authorReinette Chatre <reinette.chatre@intel.com>
Thu, 13 Aug 2009 20:30:50 +0000 (13:30 -0700)
committerJohn W. Linville <linville@tuxdriver.com>
Thu, 20 Aug 2009 15:33:09 +0000 (11:33 -0400)
commite6a6cf4c42e0dc3541a63b5f0f88299f982d6704
tree574aabd9f6e94079697da91b1ad9c8bad865f0c6
parenta8b875e7dc80ff442698d8cf4f45ccce400a6a66
iwlwifi: prevent read outside array bounds

With EDCA and HCCA we have 16 potential tid values. This is accommodated by
mac80211, but iwlwifi only supports EDCA. With this implementation it is
thus possible for mac80211 to request a tid that will cause iwlwifi to read
outside array bounds. A similar problem exists if traffic is received in an
unsupported category.

We add error checking to catch these situations.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/iwlwifi/iwl-agn-rs.c
drivers/net/wireless/iwlwifi/iwl-tx.c
drivers/net/wireless/iwlwifi/iwl3945-base.c