From patchwork Mon Jun 14 18:24:32 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Reinette Chatre X-Patchwork-Id: 105996 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o5EIOhRF002524 for ; Mon, 14 Jun 2010 18:24:44 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752971Ab0FNSYm (ORCPT ); Mon, 14 Jun 2010 14:24:42 -0400 Received: from mga03.intel.com ([143.182.124.21]:7575 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752496Ab0FNSYl (ORCPT ); Mon, 14 Jun 2010 14:24:41 -0400 Received: from azsmga001.ch.intel.com ([10.2.17.19]) by azsmga101.ch.intel.com with ESMTP; 14 Jun 2010 11:24:42 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.53,415,1272870000"; d="scan'208";a="288754192" Received: from rchatre-desk.jf.intel.com (HELO localhost.localdomain) ([134.134.15.235]) by azsmga001.ch.intel.com with ESMTP; 14 Jun 2010 11:24:40 -0700 From: Reinette Chatre To: linville@tuxdriver.com Cc: linux-wireless@vger.kernel.org, ipw3945-devel@lists.sourceforge.net, Shanyu Zhao , Pradeep Kulkarni , Reinette Chatre Subject: [PATCH 2/2] iwlagn: verify flow id in compressed BA packet Date: Mon, 14 Jun 2010 11:24:32 -0700 Message-Id: <1276539872-12440-3-git-send-email-reinette.chatre@intel.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1276539872-12440-1-git-send-email-reinette.chatre@intel.com> References: <1276539872-12440-1-git-send-email-reinette.chatre@intel.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Mon, 14 Jun 2010 18:24:44 +0000 (UTC) diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c index a732f10..7d614c4 100644 --- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c @@ -1299,6 +1299,11 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv, sta_id = ba_resp->sta_id; tid = ba_resp->tid; agg = &priv->stations[sta_id].tid[tid].agg; + if (unlikely(agg->txq_id != scd_flow)) { + IWL_ERR(priv, "BA scd_flow %d does not match txq_id %d\n", + scd_flow, agg->txq_id); + return; + } /* Find index just before block-ack window */ index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);