From: Tristan Madani mwifiex_ret_wmm_get_status() uses the firmware-provided queue_index to index into priv->wmm.ac_status[] without checking it is within bounds. A firmware response with queue_index >= IEEE80211_NUM_ACS causes an access past the end of the array. Add a bounds check before using queue_index as an array index. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/net/wireless/marvell/mwifiex/wmm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c index 841505e83c7fd8..158e4a2ec0dd69 100644 --- a/drivers/net/wireless/marvell/mwifiex/wmm.c +++ b/drivers/net/wireless/marvell/mwifiex/wmm.c @@ -943,6 +943,9 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv, tlv_wmm_qstatus->flow_required, tlv_wmm_qstatus->disabled); + if (tlv_wmm_qstatus->queue_index >= IEEE80211_NUM_ACS) + break; + ac_status = &priv->wmm.ac_status[tlv_wmm_qstatus-> queue_index]; ac_status->disabled = tlv_wmm_qstatus->disabled; -- 2.47.3