lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0311/1039] mt76: fix possible OOB issue in mt76_calculate_default_rate
    Date
    From: Lorenzo Bianconi <lorenzo@kernel.org>

    [ Upstream commit d4f3d1c4d3c2bcce76a96a6562170664b25112f0 ]

    Cap max offset value to ARRAY_SIZE(mt76_rates) - 1 in
    mt76_calculate_default_rate routine in order to avoid possible Out Of
    Bound accesses.

    Fixes: 33920b2bf0483 ("mt76: add support for setting mcast rate")
    Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
    Signed-off-by: Felix Fietkau <nbd@nbd.name>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/mediatek/mt76/mac80211.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
    index 62807dc311c19..b0869ff86c49f 100644
    --- a/drivers/net/wireless/mediatek/mt76/mac80211.c
    +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
    @@ -1494,7 +1494,6 @@ EXPORT_SYMBOL_GPL(mt76_init_queue);
    u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx)
    {
    int offset = 0;
    - struct ieee80211_rate *rate;

    if (phy->chandef.chan->band != NL80211_BAND_2GHZ)
    offset = 4;
    @@ -1503,9 +1502,11 @@ u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx)
    if (rateidx < 0)
    rateidx = 0;

    - rate = &mt76_rates[offset + rateidx];
    + rateidx += offset;
    + if (rateidx >= ARRAY_SIZE(mt76_rates))
    + rateidx = offset;

    - return rate->hw_value;
    + return mt76_rates[rateidx].hw_value;
    }
    EXPORT_SYMBOL_GPL(mt76_calculate_default_rate);

    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 01:11    [W:4.019 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site