mt76: add sanity check for a-mpdu rx wcid index

Avoid dereferencing invalid ids

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 4e6f14c..a3975e3 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -644,7 +644,7 @@ mt76_airtime_flush_ampdu(struct mt76_dev *dev)
                return;
 
        wcid_idx = dev->rx_ampdu_status.wcid_idx;
-       if (dev->rx_ampdu_status.wcid_idx != 0xff)
+       if (wcid_idx < ARRAY_SIZE(dev->wcid))
                wcid = rcu_dereference(dev->wcid[wcid_idx]);
        else
                wcid = NULL;