ath9k: index out of bounds
PATCH 2/2 ath9k: index out of bounds
Check whether index is within bounds before testing the element
Signed-off-by Roel Kluin <[email protected]>
--- drivers/net/wireless/ath/ath9k/rc.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/rc.c +1 -2
@@ -1092,8 +1092,7 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,if (!(rate->flags &IEEE80211_TX_RC_MCS ))return rate->idx; -while (rate->idx > mcs_rix_off[i] && - i <ARRAY_SIZE (mcs_rix_off)) { +while (i <ARRAY_SIZE (mcs_rix_off) && rate->idx > mcs_rix_off[i]) { rix++; i++; }
Quoted 12 lines · roel
Check whether index is within bounds before testing the element
Signed-off-by Roel Kluin <[email protected]>---
?drivers/net/wireless/ath/ath9k/rc.c | ? ?3 +--
?1 files changed, 1 insertions(+), 2 deletions(-)drivers/net/wireless/ath/ath9k/rc.c +0
-0
drivers/net/wireless/ath/ath9k/rc.c static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table, · line 1098
Quoted 9 lines
drivers/net/wireless/ath/ath9k/rc.c +1
-2@@ -1092,8 +1092,7 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table, ? ? ? ?if (!(rate->flags & IEEE80211_TX_RC_MCS)) ? ? ? ? ? ? ? ?return rate->idx; - ? ? ? while (rate->idx > mcs_rix_off[i] && - ? ? ? ? ? ? ?i < ARRAY_SIZE(mcs_rix_off)) { + ? ? ? while (i < ARRAY_SIZE(mcs_rix_off) && rate->idx > mcs_rix_off[i]) { ? ? ? ? ? ? ? ?rix++; i++; ? ? ? ?}
hi,
This looks correct. with the current ath9k rate control, the MCS index never exceeded 23 and thats why the out of bounds problem never came.
thanks,
shafi
Quoted 5 lines
_______________________________________________
ath9k-devel mailing list
ath9k-devel at lists.ath9k.org
https://lists.ath9k.org/mailman/listinfo/ath9k-devel