From: Johannes Berg Date: Sun, 19 Dec 2021 10:18:11 +0000 (+0200) Subject: iwlwifi: mvm: don't trust hardware queue number X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=6438e3e0c5e8171d461428bc83f90d2a52a4db5a;p=linux.git iwlwifi: mvm: don't trust hardware queue number We don't really have much reason to mistrust the hardware queue number, but if it gets mixed up we still don't want to access some data out of bounds, so drop such frames. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20211219121514.539aecb91247.I6e555a5185bad30d7d1a4659f9c0b99325425f18@changeid Signed-off-by: Luca Coelho --- diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c index f12e571d3581a..2b42b1b1fe608 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c @@ -1918,6 +1918,9 @@ static void iwl_mvm_rx_mq_rss(struct iwl_op_mode *op_mode, struct iwl_rx_packet *pkt = rxb_addr(rxb); u16 cmd = WIDE_ID(pkt->hdr.group_id, pkt->hdr.cmd); + if (unlikely(queue >= mvm->trans->num_rx_queues)) + return; + if (unlikely(cmd == WIDE_ID(LEGACY_GROUP, FRAME_RELEASE))) iwl_mvm_rx_frame_release(mvm, napi, rxb, queue); else if (unlikely(cmd == WIDE_ID(DATA_PATH_GROUP,