package/kernel/mac80211/patches/310-mac80211-fix-invalid-read-in-minstrel_sort_best_tp_r.patch

   1 From: Adrien Schildknecht <adrien+dev@schischi.me>
   2 Date: Tue, 28 Jul 2015 10:30:16 +0200
   3 Subject: [PATCH] mac80211: fix invalid read in minstrel_sort_best_tp_rates()
   4
   5 At the last iteration of the loop, j may equal zero and thus
   6 tp_list[j - 1] causes an invalid read.
   7 Changed the logic of the loop so that j - 1 is always >= 0.
   8
   9 Signed-off-by: Adrien Schildknecht <adrien+dev@schischi.me>
  10 ---
  11
  12 --- a/net/mac80211/rc80211_minstrel.c
  13 +++ b/net/mac80211/rc80211_minstrel.c
  14 @@ -92,14 +92,15 @@ int minstrel_get_tp_avg(struct minstrel_
  15  static inline void
  16  minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list)
  17  {
  18 -       int j = MAX_THR_RATES;
  19 -       struct minstrel_rate_stats *tmp_mrs = &mi->r[j - 1].stats;
  20 +       int j;
  21 +       struct minstrel_rate_stats *tmp_mrs;
  22         struct minstrel_rate_stats *cur_mrs = &mi->r[i].stats;
  23
  24 -       while (j > 0 && (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_ewma) >
  25 -              minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_ewma))) {
  26 -               j--;
  27 +       for (j = MAX_THR_RATES; j > 0; --j) {
  28                 tmp_mrs = &mi->r[tp_list[j - 1]].stats;
  29 +               if (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_ewma) <=
  30 +                   minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_ewma))
  31 +                       break;
  32         }
  33
  34         if (j < MAX_THR_RATES - 1)