Commit 6438e3e0 authored by Johannes Berg's avatar Johannes Berg Committed by Luca Coelho
Browse files

iwlwifi: mvm: don't trust hardware queue number 



We don't really have much reason to mistrust the hardware
queue number, but if it gets mixed up we still don't want
to access some data out of bounds, so drop such frames.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211219121514.539aecb91247.I6e555a5185bad30d7d1a4659f9c0b99325425f18@changeid


Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent b6f5b647

drivers/net/wireless/intel/iwlwifi/mvm/ops.c

+3 −0
Original line number Diff line number Diff line
@@ -1918,6 +1918,9 @@ static void iwl_mvm_rx_mq_rss(struct iwl_op_mode *op_mode, 
	struct iwl_rx_packet *pkt = rxb_addr(rxb);

	u16 cmd = WIDE_ID(pkt->hdr.group_id, pkt->hdr.cmd);



	if (unlikely(queue >= mvm->trans->num_rx_queues))

		return;



	if (unlikely(cmd == WIDE_ID(LEGACY_GROUP, FRAME_RELEASE)))

		iwl_mvm_rx_frame_release(mvm, napi, rxb, queue);

	else if (unlikely(cmd == WIDE_ID(DATA_PATH_GROUP,