From: Felix Fietkau <nbd@nbd.name>
Date: Thu, 10 Oct 2019 19:59:46 +0000 (+0200)
Subject: mt76: add sanity check for a-mpdu rx wcid index
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=bf5238b25ac373cb2a544fe8554fd66fc9e04efc;p=linux.git

mt76: add sanity check for a-mpdu rx wcid index

Avoid dereferencing invalid ids

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 4e6f14ca00f2e..a3975e3795ee0 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -644,7 +644,7 @@ mt76_airtime_flush_ampdu(struct mt76_dev *dev)
 		return;
 
 	wcid_idx = dev->rx_ampdu_status.wcid_idx;
-	if (dev->rx_ampdu_status.wcid_idx != 0xff)
+	if (wcid_idx < ARRAY_SIZE(dev->wcid))
 		wcid = rcu_dereference(dev->wcid[wcid_idx]);
 	else
 		wcid = NULL;