From: Johannes Berg Date: Wed, 3 Aug 2016 07:34:39 +0000 (+0200) Subject: iwlwifi: mvm: make RSS RX more robust X-Git-Tag: v4.9-rc1~127^2~35^2~36^2~2 X-Git-Url: http://git.cascardo.eti.br/?p=cascardo%2Flinux.git;a=commitdiff_plain;h=723d11a4cdf63544a01ae7a474c202a914b67a3b iwlwifi: mvm: make RSS RX more robust If the firmware ever decides to send any new/more notifications to the RSS queues, the driver would currently try to interpret those as REPLY_RX_MPDU_CMD and, if the notification was small, access invalid memory. Prevent that by checking for REPLY_RX_MPDU_CMD explicitly which allows ignoring unexpected notifications. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho --- diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c index 55d9096da68c..43ea1e5fdfc6 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c @@ -1672,7 +1672,7 @@ static void iwl_mvm_rx_mq_rss(struct iwl_op_mode *op_mode, else if (unlikely(pkt->hdr.cmd == RX_QUEUES_NOTIFICATION && pkt->hdr.group_id == DATA_PATH_GROUP)) iwl_mvm_rx_queue_notif(mvm, rxb, queue); - else + else if (likely(pkt->hdr.cmd == REPLY_RX_MPDU_CMD)) iwl_mvm_rx_mpdu_mq(mvm, napi, rxb, queue); }