OpenWrt – Rev 4

Subversion Repositories:
Rev:
From: Sriram R <srirrama@codeaurora.org>
Date: Wed, 3 Oct 2018 08:43:50 +0530
Subject: [PATCH] ath10k: fix possible out of bound access of ath10k_rates array

While using 'ath10k_mac_get_rate_hw_value()' to obtain the hw value
from the passed bitrate, there is a chance of out of bound array access
when wrong bitrate is passed. This is fixed by comparing the bitrates
within the correct size of the ath10k_rates array.

Fixes commit f279294e9ee2 ("ath10k: add support for configuring management
packet rate"). Also correction made to some indents used in the above commit.

Signed-off-by: Sriram R <srirrama@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=34e141eea7dd8525dd1ef7a925459e455b4d307f
---
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -166,7 +166,7 @@ static int ath10k_mac_get_rate_hw_value(
        if (ath10k_mac_bitrate_is_cck(bitrate))
                hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6;
 
-       for (i = 0; i < sizeof(ath10k_rates); i++) {
+       for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) {
                if (ath10k_rates[i].bitrate == bitrate)
                        return hw_value_prefix | ath10k_rates[i].hw_value;
        }
@@ -5699,22 +5699,22 @@ static void ath10k_bss_info_changed(stru
                        return;
                }
 
-       sband = ar->hw->wiphy->bands[def.chan->band];
-       basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
-       bitrate = sband->bitrates[basic_rate_idx].bitrate;
-
-       hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
-       if (hw_rate_code < 0) {
-               ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
-               mutex_unlock(&ar->conf_mutex);
-               return;
-       }
+               sband = ar->hw->wiphy->bands[def.chan->band];
+               basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
+               bitrate = sband->bitrates[basic_rate_idx].bitrate;
+
+               hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
+               if (hw_rate_code < 0) {
+                       ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
+                       mutex_unlock(&ar->conf_mutex);
+                       return;
+               }
 
-       vdev_param = ar->wmi.vdev_param->mgmt_rate;
-       ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
-                                       hw_rate_code);
-       if (ret)
-               ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
+               vdev_param = ar->wmi.vdev_param->mgmt_rate;
+               ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+                                               hw_rate_code);
+               if (ret)
+                       ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
        }
 
        mutex_unlock(&ar->conf_mutex);