iwlwifi: mvm: make RSS RX more robust

If the firmware ever decides to send any new/more notifications
to the RSS queues, the driver would currently try to interpret
those as REPLY_RX_MPDU_CMD and, if the notification was small,
access invalid memory.

Prevent that by checking for REPLY_RX_MPDU_CMD explicitly which
allows ignoring unexpected notifications.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 55d9096da68c2a4f98203e18ed281d8d4af9e394..43ea1e5fdfc615683a82c9569b93dcc01b279185 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1672,7 +1672,7 @@ static void iwl_mvm_rx_mq_rss(struct iwl_op_mode *op_mode,
        else if (unlikely(pkt->hdr.cmd == RX_QUEUES_NOTIFICATION &&
                          pkt->hdr.group_id == DATA_PATH_GROUP))
                iwl_mvm_rx_queue_notif(mvm, rxb, queue);
-       else
+       else if (likely(pkt->hdr.cmd == REPLY_RX_MPDU_CMD))
                iwl_mvm_rx_mpdu_mq(mvm, napi, rxb, queue);
 }