Re: [PATCH v4 10/10] nl80211: sanitize array index in parse_txq_params

On Thu, 2018-01-18 at 16:02 -0800, Dan Williams wrote: > Wireless drivers rely on parse_txq_params to validate that > txq_params->ac is less than NL80211_NUM_ACS by the time the low-level > driver's ->conf_tx() handler is called. Use a new helper, 'array_idx', > to sanitize txq_params->ac with resp

[PATCH v4 10/10] nl80211: sanitize array index in parse_txq_params

Wireless drivers rely on parse_txq_params to validate that txq_params->ac is less than NL80211_NUM_ACS by the time the low-level driver's ->conf_tx() handler is called. Use a new helper, 'array_idx', to sanitize txq_params->ac with respect to speculation. I.e. ensure that any speculation into ->con