tree b7b400cfa3ff55247119b4af45dc9fa99c495526
parent 2ef024a80c97c26e48122f7caa623593c64b3a88
author Dan Carpenter <dan.carpenter@oracle.com> 1554368211 +0300
committer chrmhoffmann <chrmhoffmann@gmail.com> 1586629427 +0200

ath6kl: add some bounds checking

commit 5d6751eaff672ea77642e74e92e6c0ac7f9709ab upstream.

The "ev->traffic_class" and "reply->ac" variables come from the network
and they're used as an offset into the wmi->stream_exist_for_ac[] array.
Those variables are u8 so they can be 0-255 but the stream_exist_for_ac[]
array only has WMM_NUM_AC (4) elements.  We need to add a couple bounds
checks to prevent array overflows.

I also modified one existing check from "if (traffic_class > 3) {" to
"if (traffic_class >= WMM_NUM_AC) {" just to make them all consistent.

Fixes: bdcd81707973 (" Add ath6kl cleaned up driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2019-15926
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Change-Id: I0bcdbfb3acdbabfe4bc232431a91405155f34771