mwifiex: correct histogram data with appropriate index

BugLink: http://bugs.launchpad.net/bugs/1815234
[ Upstream commit 30bfce0b63fa68c14ae1613eb9d259fa18644074 ]

Correct snr/nr/rssi data index to avoid possible buffer underflow.

Signed-off-by: Xinming Hu <huxm@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
index 0cd68ffc2c74dc1c849e8011b84208ebf74a6730..51ccf10f44132eeff9bdc9c347664b37f0e93a22 100644 (file)
--- a/drivers/net/wireless/marvell/mwifiex/util.c
+++ b/drivers/net/wireless/marvell/mwifiex/util.c
@@ -708,12 +708,14 @@ void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr,
                           s8 nflr)
 {
        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+       s8 nf   = -nflr;
+       s8 rssi = snr - nflr;
 
        atomic_inc(&phist_data->num_samples);
        atomic_inc(&phist_data->rx_rate[rx_rate]);
-       atomic_inc(&phist_data->snr[snr]);
-       atomic_inc(&phist_data->noise_flr[128 + nflr]);
-       atomic_inc(&phist_data->sig_str[nflr - snr]);
+       atomic_inc(&phist_data->snr[snr + 128]);
+       atomic_inc(&phist_data->noise_flr[nf + 128]);
+       atomic_inc(&phist_data->sig_str[rssi + 128]);
 }
 
 /* function to reset histogram data during init/reset */