diff options
Diffstat (limited to 'package/kernel/mac80211/patches/319-mac80211-minstrel_ht-fix-a-crash-in-rate-sorting.patch')
-rw-r--r-- | package/kernel/mac80211/patches/319-mac80211-minstrel_ht-fix-a-crash-in-rate-sorting.patch | 47 |
1 files changed, 0 insertions, 47 deletions
diff --git a/package/kernel/mac80211/patches/319-mac80211-minstrel_ht-fix-a-crash-in-rate-sorting.patch b/package/kernel/mac80211/patches/319-mac80211-minstrel_ht-fix-a-crash-in-rate-sorting.patch deleted file mode 100644 index 784a973e0e..0000000000 --- a/package/kernel/mac80211/patches/319-mac80211-minstrel_ht-fix-a-crash-in-rate-sorting.patch +++ /dev/null @@ -1,47 +0,0 @@ -From: Felix Fietkau <nbd@openwrt.org> -Date: Tue, 18 Nov 2014 21:43:25 +0100 -Subject: [PATCH] mac80211: minstrel_ht: fix a crash in rate sorting - -The commit 5935839ad73583781b8bbe8d91412f6826e218a4 -"mac80211: improve minstrel_ht rate sorting by throughput & probability" - -introduced a crash on rate sorting that occurs when the rate added to -the sorting array is faster than all the previous rates. Due to an -off-by-one error, it reads the rate index from tp_list[-1], which -contains uninitialized stack garbage, and then uses the resulting index -for accessing the group rate stats, leading to a crash if the garbage -value is big enough. - -Cc: Thomas Huehn <thomas@net.t-labs.tu-berlin.de> -Reported-by: Jouni Malinen <j@w1.fi> -Signed-off-by: Felix Fietkau <nbd@openwrt.org> ---- - ---- a/net/mac80211/rc80211_minstrel_ht.c -+++ b/net/mac80211/rc80211_minstrel_ht.c -@@ -394,19 +394,16 @@ minstrel_ht_sort_best_tp_rates(struct mi - cur_thr = mi->groups[cur_group].rates[cur_idx].cur_tp; - cur_prob = mi->groups[cur_group].rates[cur_idx].probability; - -- tmp_group = tp_list[j - 1] / MCS_GROUP_RATES; -- tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES; -- tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp; -- tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability; -- -- while (j > 0 && (cur_thr > tmp_thr || -- (cur_thr == tmp_thr && cur_prob > tmp_prob))) { -- j--; -+ do { - tmp_group = tp_list[j - 1] / MCS_GROUP_RATES; - tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES; - tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp; - tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability; -- } -+ if (cur_thr < tmp_thr || -+ (cur_thr == tmp_thr && cur_prob <= tmp_prob)) -+ break; -+ j--; -+ } while (j > 0); - - if (j < MAX_THR_RATES - 1) { - memmove(&tp_list[j + 1], &tp_list[j], (sizeof(*tp_list) * |