]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
mac80211: minstrel_ht: fix a crash in rate sorting
authorFelix Fietkau <nbd@openwrt.org>
Tue, 18 Nov 2014 21:35:31 +0000 (22:35 +0100)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 18 Nov 2014 21:39:16 +0000 (22:39 +0100)
commit280ba51d60be6f4ca3347eaa60783314f38df72e
tree4b6f66ce8187b59e755f02f14ffd5d488b6084df
parent4f031fa9f188b2b0641ac20087d9e16bcfb4e49d
mac80211: minstrel_ht: fix a crash in rate sorting

The commit 5935839ad73583781b8bbe8d91412f6826e218a4
"mac80211: improve minstrel_ht rate sorting by throughput & probability"

introduced a crash on rate sorting that occurs when the rate added to
the sorting array is faster than all the previous rates. Due to an
off-by-one error, it reads the rate index from tp_list[-1], which
contains uninitialized stack garbage, and then uses the resulting index
for accessing the group rate stats, leading to a crash if the garbage
value is big enough.

Cc: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/rc80211_minstrel_ht.c