Dan Carpenter 4ca39ef88a ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() ... [ Upstream commit 6a950755ce ] The "tsid" is a user controlled u8 which comes from debugfs. Values more than 15 are invalid because "active_tsids" is a 16 bit variable. If the value of "tsid" is more than 31 then that leads to a shift wrapping bug. Fixes: 8fffd9e5ec ("ath6kl: Implement support for QOS-enable and QOS-disable from userspace") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200918142732.GA909725@mwanda Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-10-29 09:57:41 +01:00
..
Kconfig	drivers: net: Fix Kconfig indentation	2019-09-26 08:56:17 +02:00
Makefile	…
bmi.c	…
bmi.h	…
cfg80211.c	net: ipv4: provide __rcu annotation for ifa_list	2019-06-02 18:08:36 -07:00
cfg80211.h	…
common.h	…
core.c	…
core.h	…
debug.c	ath6kl: debug: Use struct_size() helper	2019-04-29 17:43:35 +03:00
debug.h	…
hif-ops.h	…
hif.c	…
hif.h	…
htc-ops.h	…
htc.h	…
htc_mbox.c	ath6kl: Fix a possible null-pointer dereference in ath6kl_htc_mbox_create()	2019-09-04 09:21:19 +03:00
htc_pipe.c	ath6kl: remove redundant check of status != 0	2019-04-29 17:50:10 +03:00
init.c	…
main.c	ath6kl: prevent potential array overflow in ath6kl_add_new_sta()	2020-10-29 09:57:35 +01:00
recovery.c	…
sdio.c	…
target.h	…
testmode.c	…
testmode.h	…
trace.c	…
trace.h	ath: fix SPDX tags	2019-06-26 18:11:06 +03:00
txrx.c	…
usb.c	ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()	2019-09-04 09:23:26 +03:00
wmi.c	ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd()	2020-10-29 09:57:41 +01:00
wmi.h	…