package/kernel/mac80211/patches/319-mac80211-minstrel_ht-fix-a-crash-in-rate-sorting.patch

   1 From: Felix Fietkau <nbd@openwrt.org>
   2 Date: Tue, 18 Nov 2014 21:43:25 +0100
   3 Subject: [PATCH] mac80211: minstrel_ht: fix a crash in rate sorting
   4
   5 The commit 5935839ad73583781b8bbe8d91412f6826e218a4
   6 "mac80211: improve minstrel_ht rate sorting by throughput & probability"
   7
   8 introduced a crash on rate sorting that occurs when the rate added to
   9 the sorting array is faster than all the previous rates. Due to an
  10 off-by-one error, it reads the rate index from tp_list[-1], which
  11 contains uninitialized stack garbage, and then uses the resulting index
  12 for accessing the group rate stats, leading to a crash if the garbage
  13 value is big enough.
  14
  15 Cc: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
  16 Reported-by: Jouni Malinen <j@w1.fi>
  17 Signed-off-by: Felix Fietkau <nbd@openwrt.org>
  18 ---
  19
  20 --- a/net/mac80211/rc80211_minstrel_ht.c
  21 +++ b/net/mac80211/rc80211_minstrel_ht.c
  22 @@ -394,19 +394,16 @@ minstrel_ht_sort_best_tp_rates(struct mi
  23         cur_thr = mi->groups[cur_group].rates[cur_idx].cur_tp;
  24         cur_prob = mi->groups[cur_group].rates[cur_idx].probability;
  25
  26 -       tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
  27 -       tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
  28 -       tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp;
  29 -       tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability;
  30 -
  31 -       while (j > 0 && (cur_thr > tmp_thr ||
  32 -             (cur_thr == tmp_thr && cur_prob > tmp_prob))) {
  33 -               j--;
  34 +       do {
  35                 tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
  36                 tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
  37                 tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp;
  38                 tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability;
  39 -       }
  40 +               if (cur_thr < tmp_thr ||
  41 +                   (cur_thr == tmp_thr && cur_prob <= tmp_prob))
  42 +                       break;
  43 +               j--;
  44 +       } while (j > 0);
  45
  46         if (j < MAX_THR_RATES - 1) {
  47                 memmove(&tp_list[j + 1], &tp_list[j], (sizeof(*tp_list) *