diff mbox

[1/2] mac80211: fix read outside array bounds

Message ID 3accb52e0c55e2ac8388de7903ed6adfd964671b.1341667309.git.chunkeey@googlemail.com (mailing list archive)
State Not Applicable, archived
Headers show

Commit Message

Christian Lamparter July 7, 2012, 1:07 p.m. UTC
ieee802_1d_to_ac is defined as a const int[8],
but the tid parameter has a range from 0 to 15.

Cc: stable@vger.kernel.org
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
IMHO the patch should be correct, although it's been a while.
---
 net/mac80211/tx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Johannes Berg July 7, 2012, 7:42 p.m. UTC | #1
On Sat, 2012-07-07 at 15:07 +0200, Christian Lamparter wrote:
> ieee802_1d_to_ac is defined as a const int[8],
> but the tid parameter has a range from 0 to 15.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
> ---
> IMHO the patch should be correct, although it's been a while.

It looks necessary. I'd say it shouldn't be needed for stable, but it
seems safer because we could get incoming frames with TIDs that we don't
support I guess?

It's not really "correct", but as we don't support TIDs 8-15 anyway it
doesn't matter.

John, can you apply it please?

johannes

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d2e8159..3e974f2 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2717,7 +2717,7 @@  EXPORT_SYMBOL(ieee80211_get_buffered_bc);
 void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
 			  struct sk_buff *skb, int tid)
 {
-	int ac = ieee802_1d_to_ac[tid];
+	int ac = ieee802_1d_to_ac[tid & 7];
 
 	skb_set_mac_header(skb, 0);
 	skb_set_network_header(skb, 0);