From 4dcc193aa85d92b6529c56586b3d91accfef212f Mon Sep 17 00:00:00 2001
From: Yun Park <yunp@codeaurora.org>
Date: Tue, 5 Jun 2018 11:35:59 -0700
Subject: [PATCH] qcacld-3.0: Fix out-of-bounds access in
 ol_rx_indication_handler

Fix overrunning callee's array of size 19 by evaluating argument tid
not to pass the maximum number.

Change-Id: I993339f4b9aea51e9566d213c9828825c5f2bf66
CRs-Fixed: 2232744
---
 core/dp/txrx/ol_rx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/core/dp/txrx/ol_rx.c b/core/dp/txrx/ol_rx.c
index 49bcf63e29bb..01cc3df170cb 100644
--- a/core/dp/txrx/ol_rx.c
+++ b/core/dp/txrx/ol_rx.c
@@ -538,6 +538,12 @@ ol_rx_indication_handler(ol_txrx_pdev_handle pdev,
 			 */
 			ol_rx_reorder_peer_cleanup(vdev, peer);
 		} else {
+			if (tid >= OL_TXRX_NUM_EXT_TIDS) {
+				ol_txrx_err("%s:  invalid tid, %u\n",
+					    __func__, tid);
+				WARN_ON(1);
+				return;
+			}
 			ol_rx_reorder_flush(vdev, peer, tid, seq_num_start,
 					    seq_num_end, htt_rx_flush_release);
 		}