Skip to contentSkip to conversation

ath9k: index out of bounds

PATCH In review roel 2 participants 2 messages Apr 10, 2011 – Apr 11, 2011 Qualcomm Atheros ATH9K wireless driver

lore
Share & tools
lore

roel

author
#0 lore raw

PATCH 2/2 ath9k: index out of bounds

Check whether index is within bounds before testing the element

---
 drivers/net/wireless/ath/ath9k/rc.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/rc.c +1 -2
index 4c0d36a..1809409 100644
@@ -1092,8 +1092,7 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
 	if (!(rate->flags & IEEE80211_TX_RC_MCS))
 		return rate->idx;
 
-	while (rate->idx > mcs_rix_off[i] &&
-	       i < ARRAY_SIZE(mcs_rix_off)) {
+	while (i < ARRAY_SIZE(mcs_rix_off) && rate->idx > mcs_rix_off[i]) {
 		rix++; i++;
 	}
 
#1 lore raw
Quoted 12 lines · roel

Check whether index is within bounds before testing the element

---
?drivers/net/wireless/ath/ath9k/rc.c | ? ?3 +--
?1 files changed, 1 insertions(+), 2 deletions(-)

drivers/net/wireless/ath/ath9k/rc.c +0 -0
index 4c0d36a..1809409 100644

drivers/net/wireless/ath/ath9k/rc.c static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table, · line 1098

Quoted 9 lines
drivers/net/wireless/ath/ath9k/rc.c +1 -2
@@ -1092,8 +1092,7 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
 ? ? ? ?if (!(rate->flags & IEEE80211_TX_RC_MCS))
 ? ? ? ? ? ? ? ?return rate->idx;
 
- ? ? ? while (rate->idx > mcs_rix_off[i] &&
- ? ? ? ? ? ? ?i < ARRAY_SIZE(mcs_rix_off)) {
+ ? ? ? while (i < ARRAY_SIZE(mcs_rix_off) && rate->idx > mcs_rix_off[i]) {
 ? ? ? ? ? ? ? ?rix++; i++;
 ? ? ? ?}
 

hi,
This looks correct. with the current ath9k rate control, the MCS index never exceeded 23 and thats why the out of bounds problem never came.
thanks,
shafi

Quoted 5 lines

_______________________________________________
ath9k-devel mailing list
ath9k-devel at lists.ath9k.org
https://lists.ath9k.org/mailman/listinfo/ath9k-devel