Unverified Commit 79f8ce64 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5466 wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/67CUQMMIYM27HQMJPQCEPRHBVNHOI7CH/ 
 
https://gitee.com/src-openeuler/kernel/issues/I96G7W 
 
Link:https://gitee.com/openeuler/kernel/pulls/5466

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 1a79212e 0a990ed1

drivers/net/wireless/ath/ath9k/htc_drv_txrx.c

+3 −2
Original line number Diff line number Diff line
@@ -647,9 +647,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event) 
	struct ath9k_htc_tx_event *tx_pend;

	int i;



	for (i = 0; i < txs->cnt; i++) {

		WARN_ON(txs->cnt > HTC_MAX_TX_STATUS);

	if (WARN_ON_ONCE(txs->cnt > HTC_MAX_TX_STATUS))

		return;



	for (i = 0; i < txs->cnt; i++) {

		__txs = &txs->txstatus[i];



		skb = ath9k_htc_tx_get_packet(priv, __txs);