diff options
Diffstat (limited to 'drivers/staging/rtlwifi')
| -rw-r--r-- | drivers/staging/rtlwifi/base.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/staging/rtlwifi/base.c b/drivers/staging/rtlwifi/base.c index b81f0a943eb4..9a045c7d020c 100644 --- a/drivers/staging/rtlwifi/base.c +++ b/drivers/staging/rtlwifi/base.c @@ -1414,6 +1414,10 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx) le16_to_cpu(mgmt->u.action.u.addba_req.capab); tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2; + if (tid >= MAX_TID_COUNT) { + rcu_read_unlock(); + return true; + } tid_data = &sta_entry->tids[tid]; if (tid_data->agg.rx_agg_state == RTL_RX_AGG_START) |