| 123456789101112131415161718192021222324252627282930313233343536373839404142434445 |
- From: Konstantin Khlebnikov <koct9i@gmail.com>
- Date: Fri, 29 Jan 2016 11:35:12 +0300
- Subject: [PATCH] mac80211: minstrel_ht: fix out-of-bound in
- minstrel_ht_set_best_prob_rate
- Patch fixes this splat
- BUG: KASAN: slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
- [mac80211] at addr ffff8800cee640f4 Read of size 4 by task swapper/3/0
- Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
- Link: http://lkml.kernel.org/r/CALYGNiNyJhSaVnE35qS6UCGaSb2Dx1_i5HcRavuOX14oTz2P+w@mail.gmail.com
- ---
- --- a/net/mac80211/rc80211_minstrel_ht.c
- +++ b/net/mac80211/rc80211_minstrel_ht.c
- @@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct mi
- (max_tp_group != MINSTREL_CCK_GROUP))
- return;
-
- + max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
- + max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
- + max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
- +
- if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
- cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
- mrs->prob_ewma);
- if (cur_tp_avg > tmp_tp_avg)
- mi->max_prob_rate = index;
-
- - max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
- - max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
- - max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
- max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
- max_gpr_idx,
- max_gpr_prob);
- @@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct mi
- } else {
- if (mrs->prob_ewma > tmp_prob)
- mi->max_prob_rate = index;
- - if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
- + if (mrs->prob_ewma > max_gpr_prob)
- mg->max_group_prob_rate = index;
- }
- }
|
