linux/drivers
Reinette Chatre e6a6cf4c42 iwlwifi: prevent read outside array bounds
With EDCA and HCCA we have 16 potential tid values. This is accommodated by
mac80211, but iwlwifi only supports EDCA. With this implementation it is
thus possible for mac80211 to request a tid that will cause iwlwifi to read
outside array bounds. A similar problem exists if traffic is received in an
unsupported category.

We add error checking to catch these situations.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-08-20 11:33:09 -04:00
..
accessibility
acpi Merge branch 'misc-2.6.31' into release 2009-08-02 12:55:51 -04:00
amba [ARM] amba: fix amba device resources 2009-07-05 22:39:08 +01:00
ata libata: accept late unlocking of HPA 2009-07-28 21:07:09 -04:00
atm drivers/atm: Use DIV_ROUND_CLOSEST 2009-08-02 12:54:22 -07:00
auxdisplay
base driver core: sysdev: do not send KOBJ_ADD uevent if kobject_init_and_add fails 2009-07-28 13:45:22 -07:00
block mg_disk: Add missing ready status check on mg_write() 2009-07-28 08:57:33 +02:00
bluetooth headers: smp_lock.h redux 2009-07-12 12:22:34 -07:00
cdrom
char Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 2009-08-04 15:39:43 -07:00
clocksource
connector Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-07-23 19:03:51 -07:00
cpufreq [CPUFREQ] Make cpufreq suspend code conditional on powerpc. 2009-08-04 14:32:11 -04:00
cpuidle
crypto
dca
dio
dma Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx 2009-07-30 16:46:31 -07:00
edac amd64_edac: print debug statements only on error 2009-08-04 12:10:06 +02:00
eisa
firewire Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 2009-07-06 14:03:44 -07:00
firmware
gpio headers: smp_lock.h redux 2009-07-12 12:22:34 -07:00
gpu drm/i915: silence vblank warnings 2009-08-09 12:25:29 +10:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2009-07-22 09:30:07 -07:00
hwmon hwmon: (asus_atk0110) Fix upper limit readings 2009-07-28 16:31:39 +02:00
i2c i2c-omap: OMAP3430 Silicon Errata 1.153 2009-07-30 01:03:24 +01:00
ide ide-tape: Don't leak kernel stack information 2009-07-21 20:36:25 -07:00
idle
ieee1394 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 2009-07-06 14:03:44 -07:00
ieee802154 fakehard: use START-CONFIRM primitive to report START failure 2009-08-12 21:54:52 -07:00
infiniband
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2009-08-07 10:42:14 -07:00
isdn Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
leds Update Yoichi Yuasa's e-mail address 2009-07-03 15:45:29 +01:00
lguest lguest and virtio: cleanup struct definitions to Linux style. 2009-07-30 16:03:46 +09:30
macintosh
mca
md md: Use revalidate_disk to effect changes in size of device. 2009-08-03 10:59:58 +10:00
media Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
memstick
message net: use NETDEV_TX_OK instead of 0 in ndo_start_xmit() functions 2009-07-05 19:16:04 -07:00
mfd mfd: twl4030 irq fixes 2009-08-04 20:31:32 +02:00
misc Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
mmc drivers/mmc: correct error-handling code 2009-08-07 10:39:56 -07:00
mtd Merge branch 'for-linus' of git://git.infradead.org/ubi-2.6 2009-08-09 14:58:34 -07:00
net iwlwifi: prevent read outside array bounds 2009-08-20 11:33:09 -04:00
nubus
of of/mdio: Add support function for Ethernet fixed-link property 2009-07-22 09:27:18 -07:00
oprofile oprofile: reset bt_lost_no_mapping with other stats 2009-07-10 12:35:36 +02:00
parisc parisc: hppb.c - fix printk format strings 2009-08-02 15:42:39 +02:00
parport
pci intel-iommu: Fix enabling snooping feature by mistake 2009-08-06 11:35:50 +01:00
pcmcia Remove multiple KERN_ prefixes from printk formats 2009-07-08 10:30:03 -07:00
platform Merge branch 'bugzilla-13825' into release 2009-08-02 12:36:01 -04:00
pnp
power Merge git://git.infradead.org/users/cbou/battery-2.6.31 2009-07-30 16:45:53 -07:00
pps
ps3
rapidio
regulator
rtc rtc: mark if rtc-cmos drivers were successfully registered 2009-07-29 19:10:35 -07:00
s390 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
sbus
scsi Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-04 15:38:34 -07:00
serial Merge master.kernel.org:/home/rmk/linux-2.6-arm 2009-08-07 10:46:51 -07:00
sh
sn
spi spi: omap2_mcspi rxdma bugfix 2009-07-29 19:10:35 -07:00
ssb ssb: Implement the remaining rev.8 SPROM vars needed for LP-PHY 2009-08-14 09:14:02 -04:00
staging Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
tc
telephony headers: smp_lock.h redux 2009-07-12 12:22:34 -07:00
thermal
uio
usb f_phonet: use page-sized rather than MTU-sized RX buffers 2009-08-12 20:44:49 -07:00
uwb
video Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
virtio virtio: refactor find_vqs 2009-07-30 16:03:45 +09:30
vlynq vlynq: fix typo in Kconfig to enable debugging 2009-07-06 13:57:03 -07:00
w1 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-08-12 17:44:53 -07:00
watchdog Merge master.kernel.org:/home/rmk/linux-2.6-arm 2009-08-07 10:46:51 -07:00
xen
zorro
Kconfig
Makefile