diff options
| author | Emmanuel Grumbach <[email protected]> | 2017-06-08 10:55:26 +0300 |
|---|---|---|
| committer | Luca Coelho <[email protected]> | 2017-07-21 12:26:36 +0300 |
| commit | 0b0f934e92a8eaed2e6c48a50eae6f84661f74f3 (patch) | |
| tree | 8f9ec30b87169be89cb26cd479460adc7d274efe /tools/perf/scripts/python/call-graph-from-sql.py | |
| parent | 271612d72da5b46715447bc18add4a1cf7d87687 (diff) | |
iwlwifi: dvm: prevent an out of bounds access
iwlagn_check_ratid_empty takes the tid as a parameter, but
it doesn't check that it is not IWL_TID_NON_QOS.
Since IWL_TID_NON_QOS = 8 and iwl_priv::tid_data is an array
with 8 entries, accessing iwl_priv::tid_data[IWL_TID_NON_QOS]
is a bad idea.
This happened in iwlagn_rx_reply_tx. Since
iwlagn_check_ratid_empty is relevant only to check whether
we can open A-MPDU, this flow is irrelevant if tid is
IWL_TID_NON_QOS. Call iwlagn_check_ratid_empty only inside
the
if (tid != IWL_TID_NON_QOS)
a few lines earlier in the function.
Cc: <[email protected]>
Reported-by: Seraphime Kirkovski <[email protected]>
Tested-by: Seraphime Kirkovski <[email protected]>
Signed-off-by: Emmanuel Grumbach <[email protected]>
Signed-off-by: Luca Coelho <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/call-graph-from-sql.py')
0 files changed, 0 insertions, 0 deletions