Dan Carpenter 6a950755ce ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() ...

The "tsid" is a user controlled u8 which comes from debugfs.  Values
more than 15 are invalid because "active_tsids" is a 16 bit variable.
If the value of "tsid" is more than 31 then that leads to a shift
wrapping bug.

Fixes: 8fffd9e5ec ("ath6kl: Implement support for QOS-enable and QOS-disable from userspace")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200918142732.GA909725@mwanda

2020-09-22 10:46:46 +03:00

..

bmi.c

ath6kl: replace GFP_ATOMIC with GFP_KERNEL in ath6kl_bmi_init()

2018-07-31 10:48:45 +03:00

bmi.h

…

cfg80211.c

ath6kl: Use fallthrough pseudo-keyword

2020-08-17 13:21:19 +03:00

cfg80211.h

…

common.h

ath6kl: add ath6kl_ prefix to crypto_type

2018-12-13 09:58:52 +01:00

core.c

…

core.h

ath6kl: Replace zero-length array with flexible-array

2020-05-06 09:21:30 +03:00

debug.c

ath6kl: Replace zero-length array with flexible-array

2020-05-06 09:21:30 +03:00

debug.h

…

hif-ops.h

…

hif.c

…

hif.h

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2020-06-03 16:27:18 -07:00

htc_mbox.c

ath6kl: Fix a possible null-pointer dereference in ath6kl_htc_mbox_create()

2019-09-04 09:21:19 +03:00

htc_pipe.c

ath6kl: remove redundant check of status != 0

2019-04-29 17:50:10 +03:00

htc-ops.h

…

htc.h

…

init.c

Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git

2020-08-18 16:17:20 +03:00

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

main.c

ath6kl: prevent potential array overflow in ath6kl_add_new_sta()

2020-08-17 13:22:08 +03:00

Makefile

…

recovery.c

…

sdio.c

mmc: sdio: Move SDIO IDs from ath6kl driver to common include file

2020-05-29 12:37:59 +02:00

target.h

…

testmode.c

netlink: make validation more configurable for future strictness

2019-04-27 17:07:21 -04:00

testmode.h

…

trace.c

…

trace.h

ath: fix SPDX tags

2019-06-26 18:11:06 +03:00

txrx.c

ath6kl: remove redundant variables netlen, orig_buf, orig_len, dropped and stats

2018-07-30 20:57:05 +03:00

usb.c

wireless: Fix trivial spelling

2020-07-15 19:48:14 +03:00

wmi.c

ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd()

2020-09-22 10:46:46 +03:00

wmi.h

ath6kl: add ath6kl_ prefix to crypto_type

2018-12-13 09:58:52 +01:00