Unverified Commit c09d565e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15468 ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zeng Heng <zengheng4@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/YVMUBWXWG56EGHWBYQLL5XD7IKMWM324/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBP32T 
 
Link:https://gitee.com/openeuler/kernel/pulls/15468

 

Reviewed-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents c93a73e5 bc776fd1

drivers/net/wireless/ath/ath9k/htc_drv_txrx.c

+8 −0
Original line number Diff line number Diff line
@@ -1007,6 +1007,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, 
		goto rx_next;

	}



	if (rxstatus->rs_keyix >= ATH_KEYMAX &&

	    rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) {

		ath_dbg(common, ANY,

			"Invalid keyix, dropping (keyix: %d)\n",

			rxstatus->rs_keyix);

		goto rx_next;

	}



	/* Get the RX status information */



	memset(rx_status, 0, sizeof(struct ieee80211_rx_status));