diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2019-04-02 10:03:38 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2019-04-04 13:20:47 +0300 |
| commit | 2cd2b42439ea7d1231b6b3f0eb0fe606f2ba5160 (patch) | |
| tree | 6629be61441e2a2584d3254291564324e4a869ca /drivers/net/wireless/marvell/mwifiex/sta_rx.c | |
| parent | 003b686ace820ce2d635a83f10f2d7f9c147dabc (diff) | |
mwifiex: add a bounds check in mwifiex_process_sta_rx_packet()
Smatch complains that "local_rx_pd->priority" can't be trusted because
it comes from skb->data and it can go up to 255 instead of being capped
in the 0-7 range. A few lines earlier, on the other side of the if
statement, we cap priority so it seems harmless to add a bounds check
here as well.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/sta_rx.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/sta_rx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c index fb28a5c7f441..52a2ce2e78b0 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c @@ -250,7 +250,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv, local_rx_pd->nf); } } else { - if (rx_pkt_type != PKT_TYPE_BAR) + if (rx_pkt_type != PKT_TYPE_BAR && + local_rx_pd->priority < MAX_NUM_TID) priv->rx_seq[local_rx_pd->priority] = seq_num; memcpy(ta, priv->curr_bss_params.bss_descriptor.mac_address, ETH_ALEN); |