[PATCH] wifi: mwifiex: validate queue_index in WMM status response

[Aamir Ahmed]

The queue_index field in the WMM queue status TLV from the firmware is
used to index into the ac_status array, which has IEEE80211_NUM_ACS (4)
entries. A malicious device (especially via USB) could send a
queue_index value >= 4, causing an out-of-bounds array write.

Add a bounds check before using queue_index as an array index.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
---
 drivers/net/wireless/marvell/mwifiex/wmm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c
index 841505e83c7f..febea68487e8 100644
--- a/drivers/net/wireless/marvell/mwifiex/wmm.c
+++ b/drivers/net/wireless/marvell/mwifiex/wmm.c
@@ -943,6 +943,8 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
 				    tlv_wmm_qstatus->flow_required,
 				    tlv_wmm_qstatus->disabled);
 
+			if (tlv_wmm_qstatus->queue_index >= IEEE80211_NUM_ACS)
+				break;
 			ac_status = &priv->wmm.ac_status[tlv_wmm_qstatus->
 							 queue_index];
 			ac_status->disabled = tlv_wmm_qstatus->disabled;
-- 
2.43.0