OpenWrt – Blame information for rev 4
?pathlinks?
Rev | Author | Line No. | Line |
---|---|---|---|
1 | office | 1 | From: Sriram R <srirrama@codeaurora.org> |
2 | Date: Wed, 3 Oct 2018 08:43:50 +0530 |
||
3 | Subject: [PATCH] ath10k: fix possible out of bound access of ath10k_rates array |
||
4 | |||
5 | While using 'ath10k_mac_get_rate_hw_value()' to obtain the hw value |
||
6 | from the passed bitrate, there is a chance of out of bound array access |
||
7 | when wrong bitrate is passed. This is fixed by comparing the bitrates |
||
8 | within the correct size of the ath10k_rates array. |
||
9 | |||
10 | Fixes commit f279294e9ee2 ("ath10k: add support for configuring management |
||
11 | packet rate"). Also correction made to some indents used in the above commit. |
||
12 | |||
13 | Signed-off-by: Sriram R <srirrama@codeaurora.org> |
||
14 | Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
||
15 | |||
16 | Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=34e141eea7dd8525dd1ef7a925459e455b4d307f |
||
17 | --- |
||
18 | --- a/drivers/net/wireless/ath/ath10k/mac.c |
||
19 | +++ b/drivers/net/wireless/ath/ath10k/mac.c |
||
20 | @@ -166,7 +166,7 @@ static int ath10k_mac_get_rate_hw_value( |
||
21 | if (ath10k_mac_bitrate_is_cck(bitrate)) |
||
22 | hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6; |
||
23 | |||
24 | - for (i = 0; i < sizeof(ath10k_rates); i++) { |
||
25 | + for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) { |
||
26 | if (ath10k_rates[i].bitrate == bitrate) |
||
27 | return hw_value_prefix | ath10k_rates[i].hw_value; |
||
28 | } |
||
29 | @@ -5699,22 +5699,22 @@ static void ath10k_bss_info_changed(stru |
||
30 | return; |
||
31 | } |
||
32 | |||
33 | - sband = ar->hw->wiphy->bands[def.chan->band]; |
||
34 | - basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1; |
||
35 | - bitrate = sband->bitrates[basic_rate_idx].bitrate; |
||
36 | - |
||
37 | - hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate); |
||
38 | - if (hw_rate_code < 0) { |
||
39 | - ath10k_warn(ar, "bitrate not supported %d\n", bitrate); |
||
40 | - mutex_unlock(&ar->conf_mutex); |
||
41 | - return; |
||
42 | - } |
||
43 | + sband = ar->hw->wiphy->bands[def.chan->band]; |
||
44 | + basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1; |
||
45 | + bitrate = sband->bitrates[basic_rate_idx].bitrate; |
||
46 | + |
||
47 | + hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate); |
||
48 | + if (hw_rate_code < 0) { |
||
49 | + ath10k_warn(ar, "bitrate not supported %d\n", bitrate); |
||
50 | + mutex_unlock(&ar->conf_mutex); |
||
51 | + return; |
||
52 | + } |
||
53 | |||
54 | - vdev_param = ar->wmi.vdev_param->mgmt_rate; |
||
55 | - ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, |
||
56 | - hw_rate_code); |
||
57 | - if (ret) |
||
58 | - ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret); |
||
59 | + vdev_param = ar->wmi.vdev_param->mgmt_rate; |
||
60 | + ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, |
||
61 | + hw_rate_code); |
||
62 | + if (ret) |
||
63 | + ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret); |
||
64 | } |
||
65 | |||
66 | mutex_unlock(&ar->conf_mutex); |