diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2021-12-19 12:18:11 +0200 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2021-12-21 12:35:06 +0200 |
| commit | 6438e3e0c5e8171d461428bc83f90d2a52a4db5a (patch) | |
| tree | 99785e1a492e165305babcc387c63e7de8a47bcb | |
| parent | b6f5b647f694fdee06ddfdcb1cb3162b00de29fb (diff) | |
| download | wireless-drivers-next-6438e3e0c5e8171d461428bc83f90d2a52a4db5a.tar.gz | |
iwlwifi: mvm: don't trust hardware queue number
We don't really have much reason to mistrust the hardware
queue number, but if it gets mixed up we still don't want
to access some data out of bounds, so drop such frames.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211219121514.539aecb91247.I6e555a5185bad30d7d1a4659f9c0b99325425f18@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c index f12e571d3581a7..2b42b1b1fe6083 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c @@ -1918,6 +1918,9 @@ static void iwl_mvm_rx_mq_rss(struct iwl_op_mode *op_mode, struct iwl_rx_packet *pkt = rxb_addr(rxb); u16 cmd = WIDE_ID(pkt->hdr.group_id, pkt->hdr.cmd); + if (unlikely(queue >= mvm->trans->num_rx_queues)) + return; + if (unlikely(cmd == WIDE_ID(LEGACY_GROUP, FRAME_RELEASE))) iwl_mvm_rx_frame_release(mvm, napi, rxb, queue); else if (unlikely(cmd == WIDE_ID(DATA_PATH_GROUP, |