iwlwifi: prevent read outside array bounds

[pandora-kernel.git] / drivers / net / wireless / iwlwifi / iwl-tx.c

diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 288b871..7686fc7 100644 (file)
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -668,14 +668,6 @@ static void iwl_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
        }
 }
 
-static void iwl_update_tx_stats(struct iwl_priv *priv, u16 fc, u16 len)
-{
-       /* 0 - mgmt, 1 - cnt, 2 - data */
-       int idx = (fc & IEEE80211_FCTL_FTYPE) >> 2;
-       priv->tx_stats[idx].cnt++;
-       priv->tx_stats[idx].bytes += len;
-}
-
 /*
  * start REPLY_TX command process
  */
@@ -753,6 +745,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        if (ieee80211_is_data_qos(fc)) {
                qc = ieee80211_get_qos_ctl(hdr);
                tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+               if (unlikely(tid >= MAX_TID_COUNT))
+                       goto drop_unlock;
                seq_number = priv->stations[sta_id].tid[tid].seq_number;
                seq_number &= IEEE80211_SCTL_SEQ;
                hdr->seq_ctrl = hdr->seq_ctrl &
@@ -808,12 +802,12 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
        /* TODO need this for burst mode later on */
        iwl_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
+       iwl_dbg_log_tx_data_frame(priv, len, hdr);
 
        /* set is_hcca to 0; it probably will never be implemented */
        iwl_tx_cmd_build_rate(priv, tx_cmd, info, fc, sta_id, 0);
 
-       iwl_update_tx_stats(priv, le16_to_cpu(fc), len);
-
+       iwl_update_stats(priv, true, fc, len);
        /*
         * Use the first empty entry in this queue's command buffer array
         * to contain the Tx command and MAC header concatenated together
@@ -884,8 +878,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
                     le16_to_cpu(out_cmd->hdr.sequence));
        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
-       iwl_print_hex_dump(IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
-       iwl_print_hex_dump(IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
+       iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
+       iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
 
        /* Set up entry for this TFD in Tx byte-count array */
        if (info->flags & IEEE80211_TX_CTL_AMPDU)
@@ -1246,6 +1240,9 @@ int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
                return -EINVAL;
        }
 
+       if (unlikely(tid >= MAX_TID_COUNT))
+               return -EINVAL;
+
        if (likely(tid < ARRAY_SIZE(default_tid_to_tx_fifo)))
                tx_fifo_id = default_tid_to_tx_fifo[tid];
        else