From patchwork Wed Dec 18 16:07:51 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Markus Theil X-Patchwork-Id: 11301187 X-Patchwork-Delegate: nbd@nbd.name Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B1F1214B7 for ; Wed, 18 Dec 2019 16:08:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9981F218AC for ; Wed, 18 Dec 2019 16:08:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727462AbfLRQIy (ORCPT ); Wed, 18 Dec 2019 11:08:54 -0500 Received: from smail.rz.tu-ilmenau.de ([141.24.186.67]:51420 "EHLO smail.rz.tu-ilmenau.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727257AbfLRQIx (ORCPT ); Wed, 18 Dec 2019 11:08:53 -0500 Received: from isengard.tu-ilmenau.de (unknown [141.24.207.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smail.rz.tu-ilmenau.de (Postfix) with ESMTPSA id 36887580078; Wed, 18 Dec 2019 17:08:52 +0100 (CET) From: Markus Theil To: nbd@nbd.name Cc: linux-wireless@vger.kernel.org, lorenzo.bianconi@redhat.com, Stanislaw Gruszka , kvalo@codeaurora.org, Markus Theil Subject: [PATCH v10 3/6] mt76: mt76x02: add check for invalid vif idx Date: Wed, 18 Dec 2019 17:07:51 +0100 Message-Id: <20191218160754.24111-4-markus.theil@tu-ilmenau.de> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191218160754.24111-1-markus.theil@tu-ilmenau.de> References: <20191218160754.24111-1-markus.theil@tu-ilmenau.de> MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org On adding vifs the idx can become 1 + (7 & 7) = 8 for APs. Check against that, as only AP vif idx 0-7 is possible. Signed-off-by: Markus Theil --- drivers/net/wireless/mediatek/mt76/mt76x02_util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c index 889566b36a40..6073f8a4a8f6 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c @@ -325,7 +325,9 @@ mt76x02_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) if (vif->type == NL80211_IFTYPE_STATION) idx += 8; - if (dev->vif_mask & BIT(idx)) + /* vif is already set or idx is 8 for AP/Mesh/... */ + if (dev->vif_mask & BIT(idx) || + (vif->type != NL80211_IFTYPE_STATION && idx > 7)) return -EBUSY; dev->vif_mask |= BIT(idx);