| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566 |
- From: Sriram R <[email protected]>
- Date: Wed, 3 Oct 2018 08:43:50 +0530
- Subject: [PATCH] ath10k: fix possible out of bound access of ath10k_rates array
- While using 'ath10k_mac_get_rate_hw_value()' to obtain the hw value
- from the passed bitrate, there is a chance of out of bound array access
- when wrong bitrate is passed. This is fixed by comparing the bitrates
- within the correct size of the ath10k_rates array.
- Fixes commit f279294e9ee2 ("ath10k: add support for configuring management
- packet rate"). Also correction made to some indents used in the above commit.
- Signed-off-by: Sriram R <[email protected]>
- Signed-off-by: Kalle Valo <[email protected]>
- Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=34e141eea7dd8525dd1ef7a925459e455b4d307f
- ---
- --- a/drivers/net/wireless/ath/ath10k/mac.c
- +++ b/drivers/net/wireless/ath/ath10k/mac.c
- @@ -166,7 +166,7 @@ static int ath10k_mac_get_rate_hw_value(
- if (ath10k_mac_bitrate_is_cck(bitrate))
- hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6;
-
- - for (i = 0; i < sizeof(ath10k_rates); i++) {
- + for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) {
- if (ath10k_rates[i].bitrate == bitrate)
- return hw_value_prefix | ath10k_rates[i].hw_value;
- }
- @@ -5699,22 +5699,22 @@ static void ath10k_bss_info_changed(stru
- return;
- }
-
- - sband = ar->hw->wiphy->bands[def.chan->band];
- - basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
- - bitrate = sband->bitrates[basic_rate_idx].bitrate;
- -
- - hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
- - if (hw_rate_code < 0) {
- - ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
- - mutex_unlock(&ar->conf_mutex);
- - return;
- - }
- + sband = ar->hw->wiphy->bands[def.chan->band];
- + basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
- + bitrate = sband->bitrates[basic_rate_idx].bitrate;
- +
- + hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
- + if (hw_rate_code < 0) {
- + ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
- + mutex_unlock(&ar->conf_mutex);
- + return;
- + }
-
- - vdev_param = ar->wmi.vdev_param->mgmt_rate;
- - ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
- - hw_rate_code);
- - if (ret)
- - ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
- + vdev_param = ar->wmi.vdev_param->mgmt_rate;
- + ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
- + hw_rate_code);
- + if (ret)
- + ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
- }
-
- mutex_unlock(&ar->conf_mutex);
|
