Patch "iwlwifi: dvm: prevent an out of bounds access" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

iwlwifi: dvm: prevent an out of bounds access

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
iwlwifi-dvm-prevent-an-out-of-bounds-access.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Emmanuel Grumbach <[email protected]>
Date: Thu, 8 Jun 2017 10:55:26 +0300
Subject: iwlwifi: dvm: prevent an out of bounds access

From: Emmanuel Grumbach <[email protected]>

commit 0b0f934e92a8eaed2e6c48a50eae6f84661f74f3 upstream.

iwlagn_check_ratid_empty takes the tid as a parameter, but it doesn't check that it is not IWL_TID_NON_QOS. Since IWL_TID_NON_QOS = 8 and iwl_priv::tid_data is an array with 8 entries, accessing iwl_priv::tid_data[IWL_TID_NON_QOS] is a bad idea.
This happened in iwlagn_rx_reply_tx. Since iwlagn_check_ratid_empty is relevant only to check whether we can open A-MPDU, this flow is irrelevant if tid is IWL_TID_NON_QOS. Call iwlagn_check_ratid_empty only inside the

	if (tid != IWL_TID_NON_QOS)

a few lines earlier in the function.

---
 drivers/net/wireless/intel/iwlwifi/dvm/tx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1190,11 +1190,11 @@ void iwlagn_rx_reply_tx(struct iwl_priv
 				next_reclaimed;
 			IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
 						  next_reclaimed);
+			iwlagn_check_ratid_empty(priv, sta_id, tid);
 		}
 
 		iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
 
-		iwlagn_check_ratid_empty(priv, sta_id, tid);
 		freed = 0;
 
 		/* process frames */

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/iwlwifi-dvm-prevent-an-out-of-bounds-access.patch