46 lines
1.7 KiB
Diff
46 lines
1.7 KiB
Diff
|
From: Konstantin Khlebnikov <koct9i@gmail.com>
|
||
|
|
Date: Fri, 29 Jan 2016 11:35:12 +0300
|
||
|
|
Subject: [PATCH] mac80211: minstrel_ht: fix out-of-bound in
|
||
|
|
minstrel_ht_set_best_prob_rate
|
||
|
|
|
||
|
|
Patch fixes this splat
|
||
|
|
|
||
|
|
BUG: KASAN: slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
|
||
|
|
[mac80211] at addr ffff8800cee640f4 Read of size 4 by task swapper/3/0
|
||
|
|
|
||
|
|
Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
|
||
|
|
Link: http://lkml.kernel.org/r/CALYGNiNyJhSaVnE35qS6UCGaSb2Dx1_i5HcRavuOX14oTz2P+w@mail.gmail.com
|
||
|
|
---
|
||
|
|
|
||
|
|
--- a/net/mac80211/rc80211_minstrel_ht.c
|
||
|
|
+++ b/net/mac80211/rc80211_minstrel_ht.c
|
||
|
|
@@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct mi
|
||
|
|
(max_tp_group != MINSTREL_CCK_GROUP))
|
||
|
|
return;
|
||
|
|
|
||
|
|
+ max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
|
||
|
|
+ max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
|
||
|
|
+ max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
|
||
|
|
+
|
||
|
|
if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
|
||
|
|
cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
|
||
|
|
mrs->prob_ewma);
|
||
|
|
if (cur_tp_avg > tmp_tp_avg)
|
||
|
|
mi->max_prob_rate = index;
|
||
|
|
|
||
|
|
- max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
|
||
|
|
- max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
|
||
|
|
- max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
|
||
|
|
max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
|
||
|
|
max_gpr_idx,
|
||
|
|
max_gpr_prob);
|
||
|
|
@@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct mi
|
||
|
|
} else {
|
||
|
|
if (mrs->prob_ewma > tmp_prob)
|
||
|
|
mi->max_prob_rate = index;
|
||
|
|
- if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
|
||
|
|
+ if (mrs->prob_ewma > max_gpr_prob)
|
||
|
|
mg->max_group_prob_rate = index;
|
||
|
|
}
|
||
|
|
}
|