Commit f84a9372 authored by Konstantin Khlebnikov's avatar Konstantin Khlebnikov Committed by Johannes Berg

mac80211: minstrel_ht: fix out-of-bound in minstrel_ht_set_best_prob_rate

Patch fixes this splat

BUG: KASAN: slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
[mac80211] at addr ffff8800cee640f4 Read of size 4 by task swapper/3/0
Signed-off-by: default avatarKonstantin Khlebnikov <koct9i@gmail.com>
Link: http://lkml.kernel.org/r/CALYGNiNyJhSaVnE35qS6UCGaSb2Dx1_i5HcRavuOX14oTz2P+w@mail.gmail.comAcked-by: default avatarFelix Fietkau <nbd@openwrt.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent f39ea269
...@@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index) ...@@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index)
(max_tp_group != MINSTREL_CCK_GROUP)) (max_tp_group != MINSTREL_CCK_GROUP))
return; return;
max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) { if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx, cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
mrs->prob_ewma); mrs->prob_ewma);
if (cur_tp_avg > tmp_tp_avg) if (cur_tp_avg > tmp_tp_avg)
mi->max_prob_rate = index; mi->max_prob_rate = index;
max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group, max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
max_gpr_idx, max_gpr_idx,
max_gpr_prob); max_gpr_prob);
...@@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index) ...@@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct minstrel_ht_sta *mi, u16 index)
} else { } else {
if (mrs->prob_ewma > tmp_prob) if (mrs->prob_ewma > tmp_prob)
mi->max_prob_rate = index; mi->max_prob_rate = index;
if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma) if (mrs->prob_ewma > max_gpr_prob)
mg->max_group_prob_rate = index; mg->max_group_prob_rate = index;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment