package/kernel/ath10k-ct/patches/162-ath10k-fix-possible-out-of-bound-access-of-ath10k_ra.patch

   1 From: Sriram R <srirrama@codeaurora.org>
   2 Date: Wed, 3 Oct 2018 08:43:50 +0530
   3 Subject: [PATCH] ath10k: fix possible out of bound access of ath10k_rates array
   4
   5 While using 'ath10k_mac_get_rate_hw_value()' to obtain the hw value
   6 from the passed bitrate, there is a chance of out of bound array access
   7 when wrong bitrate is passed. This is fixed by comparing the bitrates
   8 within the correct size of the ath10k_rates array.
   9
  10 Fixes commit f279294e9ee2 ("ath10k: add support for configuring management
  11 packet rate"). Also correction made to some indents used in the above commit.
  12
  13 Signed-off-by: Sriram R <srirrama@codeaurora.org>
  14 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  15
  16 Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=34e141eea7dd8525dd1ef7a925459e455b4d307f
  17 ---
  18 --- a/ath10k-4.19/mac.c
  19 +++ b/ath10k-4.19/mac.c
  20 @@ -165,7 +165,7 @@ static int ath10k_mac_get_rate_hw_value(
  21         if (ath10k_mac_bitrate_is_cck(bitrate))
  22                 hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6;
  23
  24 -       for (i = 0; i < sizeof(ath10k_rates); i++) {
  25 +       for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) {
  26                 if (ath10k_rates[i].bitrate == bitrate)
  27                         return hw_value_prefix | ath10k_rates[i].hw_value;
  28         }
  29 @@ -6479,22 +6479,22 @@ static void ath10k_bss_info_changed(stru
  30                         return;
  31                 }
  32
  33 -       sband = ar->hw->wiphy->bands[def.chan->band];
  34 -       basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
  35 -       bitrate = sband->bitrates[basic_rate_idx].bitrate;
  36 -
  37 -       hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
  38 -       if (hw_rate_code < 0) {
  39 -               ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
  40 -               mutex_unlock(&ar->conf_mutex);
  41 -               return;
  42 -       }
  43 +               sband = ar->hw->wiphy->bands[def.chan->band];
  44 +               basic_rate_idx = ffs(vif->bss_conf.basic_rates) - 1;
  45 +               bitrate = sband->bitrates[basic_rate_idx].bitrate;
  46 +
  47 +               hw_rate_code = ath10k_mac_get_rate_hw_value(bitrate);
  48 +               if (hw_rate_code < 0) {
  49 +                       ath10k_warn(ar, "bitrate not supported %d\n", bitrate);
  50 +                       mutex_unlock(&ar->conf_mutex);
  51 +                       return;
  52 +               }
  53
  54 -       vdev_param = ar->wmi.vdev_param->mgmt_rate;
  55 -       ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
  56 -                                       hw_rate_code);
  57 -       if (ret)
  58 -               ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
  59 +               vdev_param = ar->wmi.vdev_param->mgmt_rate;
  60 +               ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
  61 +                                               hw_rate_code);
  62 +               if (ret)
  63 +                       ath10k_warn(ar, "failed to set mgmt tx rate %d\n", ret);
  64         }
  65
  66         mutex_unlock(&ar->conf_mutex);