package/kernel/mac80211/patches/317-mac80211-minstrel_ht-fix-out-of-bound-in-minstrel_ht.patch

   1 From: Konstantin Khlebnikov <koct9i@gmail.com>
   2 Date: Fri, 29 Jan 2016 11:35:12 +0300
   3 Subject: [PATCH] mac80211: minstrel_ht: fix out-of-bound in
   4  minstrel_ht_set_best_prob_rate
   5
   6 Patch fixes this splat
   7
   8 BUG: KASAN: slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
   9 [mac80211] at addr ffff8800cee640f4 Read of size 4 by task swapper/3/0
  10
  11 Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
  12 Link: http://lkml.kernel.org/r/CALYGNiNyJhSaVnE35qS6UCGaSb2Dx1_i5HcRavuOX14oTz2P+w@mail.gmail.com
  13 ---
  14
  15 --- a/net/mac80211/rc80211_minstrel_ht.c
  16 +++ b/net/mac80211/rc80211_minstrel_ht.c
  17 @@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct mi
  18             (max_tp_group != MINSTREL_CCK_GROUP))
  19                 return;
  20
  21 +       max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
  22 +       max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
  23 +       max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
  24 +
  25         if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
  26                 cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
  27                                                     mrs->prob_ewma);
  28                 if (cur_tp_avg > tmp_tp_avg)
  29                         mi->max_prob_rate = index;
  30
  31 -               max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
  32 -               max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
  33 -               max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
  34                 max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
  35                                                         max_gpr_idx,
  36                                                         max_gpr_prob);
  37 @@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct mi
  38         } else {
  39                 if (mrs->prob_ewma > tmp_prob)
  40                         mi->max_prob_rate = index;
  41 -               if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
  42 +               if (mrs->prob_ewma > max_gpr_prob)
  43                         mg->max_group_prob_rate = index;
  44         }
  45  }