summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@nbd.name>2019-10-10 21:59:46 +0200
committerFelix Fietkau <nbd@nbd.name>2019-11-20 13:23:50 +0100
commitbf5238b25ac373cb2a544fe8554fd66fc9e04efc (patch)
tree0ae7b32d6fa73daee6b56201a57316092a00b68a /drivers/net/wireless
parent237312c5e485804417e0f809f948112c3eb7fc96 (diff)
downloadlinux-bf5238b25ac373cb2a544fe8554fd66fc9e04efc.tar.bz2
mt76: add sanity check for a-mpdu rx wcid index
Avoid dereferencing invalid ids Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers/net/wireless')
-rw-r--r--drivers/net/wireless/mediatek/mt76/mac80211.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 4e6f14ca00f2..a3975e3795ee 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -644,7 +644,7 @@ mt76_airtime_flush_ampdu(struct mt76_dev *dev)
return;
wcid_idx = dev->rx_ampdu_status.wcid_idx;
- if (dev->rx_ampdu_status.wcid_idx != 0xff)
+ if (wcid_idx < ARRAY_SIZE(dev->wcid))
wcid = rcu_dereference(dev->wcid[wcid_idx]);
else
wcid = NULL;