leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report

Browse Source 
Fix possible array out of bound access in mt7921_mcu_tx_rate_report.
Remove unnecessary varibable in mt7921_mcu_tx_rate_report

Fixes: 1c099ab447 ("mt76: mt7921: add MCU support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/91a1e8f6b6a3e6a929de560ed68132f6eb421720.1619187875.git.lorenzo@kernel.org
This commit is contained in:
Lorenzo Bianconi
2021-04-23 16:27:09 +02:00
committed by Kalle Valo
parent 6efb943b86
commit d874e6c069
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
View File

@@ -402,20 +402,22 @@ static void
mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb,
u16 wlan_idx)
{
struct mt7921_mcu_wlan_info_event *wtbl_info =
(struct mt7921_mcu_wlan_info_event *)(skb->data);
struct rate_info rate = {};
u8 curr_idx = wtbl_info->rate_info.rate_idx;
u16 curr = le16_to_cpu(wtbl_info->rate_info.rate[curr_idx]);
struct mt7921_mcu_peer_cap peer = wtbl_info->peer_cap;
struct mt7921_mcu_wlan_info_event *wtbl_info;
struct mt76_phy *mphy = &dev->mphy;
struct mt7921_sta_stats *stats;
struct rate_info rate = {};
struct mt7921_sta *msta;
struct mt76_wcid *wcid;
u8 idx;
if (wlan_idx >= MT76_N_WCIDS)
return;
wtbl_info = (struct mt7921_mcu_wlan_info_event *)skb->data;
idx = wtbl_info->rate_info.rate_idx;
if (idx >= ARRAY_SIZE(wtbl_info->rate_info.rate))
return;
rcu_read_lock();
wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
@@ -426,7 +428,8 @@ mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb,
stats = &msta->stats;
/* current rate */
mt7921_mcu_tx_rate_parse(mphy, &peer, &rate, curr);
mt7921_mcu_tx_rate_parse(mphy, &wtbl_info->peer_cap, &rate,
le16_to_cpu(wtbl_info->rate_info.rate[idx]));
stats->tx_rate = rate;
out:
rcu_read_unlock();