> Date: Fri, 12 Nov 2021 13:37:47 +0100
> From: Stefan Sperling <[email protected]>
>
> This tid variable is used as an array index and must thus be smaller
> than MAX_TID_COUNT (which is 8).
>
> The variable will be set to 8 if the AP wants us to use TID 8 for Rx agg,
> which I've never seen happen in practice, though it is possible.
>
> Our driver uses this value as an index into an array of
> IEEE80211_NUM_TID (16) elements, and thus would not crash.
>
> But the value is passed on to firmware which does who knows what with it.
> The Linux driver uses this value as an index into an array ("tid_to_baid")
> of MAX_TID_COUNT elements. Perhaps firmware has a similar limitation?
> I cannot tell.
>
> ok?
ok kettenis@
> diff 0433237ad58131957ccba3ddd837ed772dbec416
> 6629860d5767033824e2fb1c0f621c18216a7316
> blob - 5cac83fd48ebe997a4cd7842730b0cb05f7c28ee
> blob + 6e67f7db864ec9a7ca61057b7284e7d7a6bffe5d
> --- sys/dev/pci/if_iwx.c
> +++ sys/dev/pci/if_iwx.c
> @@ -3264,7 +3264,7 @@ iwx_ampdu_rx_start(struct ieee80211com *ic, struct iee
> struct iwx_softc *sc = IC2IFP(ic)->if_softc;
>
> if (sc->sc_rx_ba_sessions >= IWX_MAX_RX_BA_SESSIONS ||
> - tid > IWX_MAX_TID_COUNT)
> + tid >= IWX_MAX_TID_COUNT)
> return ENOSPC;
>
> if (sc->ba_rx.start_tidmask & (1 << tid))
> @@ -3286,7 +3286,7 @@ iwx_ampdu_rx_stop(struct ieee80211com *ic, struct ieee
> {
> struct iwx_softc *sc = IC2IFP(ic)->if_softc;
>
> - if (tid > IWX_MAX_TID_COUNT || sc->ba_rx.stop_tidmask & (1 << tid))
> + if (tid >= IWX_MAX_TID_COUNT || sc->ba_rx.stop_tidmask & (1 << tid))
> return;
>
> sc->ba_rx.stop_tidmask = (1 << tid);
>
>
