mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-30 22:26:55 +00:00
Code Issues Releases Wiki Activity

mac80211: fix VHT MCS mask array overrun

Browse source 
The HT MCS mask has 9 bytes, the VHT one only has 8 streams.
Split the loops to handle this correctly.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Johannes Berg 2015-08-21 14:07:13 +02:00
parent ef9be10c8c
commit 2df1b131b5
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
net/mac80211/cfg.c
View file

@ -2518,15 +2518,17 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
continue;
for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) {
if (~sdata->rc_rateidx_mcs_mask[i][j])
if (~sdata->rc_rateidx_mcs_mask[i][j]) {
sdata->rc_has_mcs_mask[i] = true;
if (~sdata->rc_rateidx_vht_mcs_mask[i][j])
sdata->rc_has_vht_mcs_mask[i] = true;
if (sdata->rc_has_mcs_mask[i] &&
sdata->rc_has_vht_mcs_mask[i])
break;
}
}
for (j = 0; j < NL80211_VHT_NSS_MAX; j++) {
if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) {
sdata->rc_has_vht_mcs_mask[i] = true;
break;
}
}
}