Backups/immortalwrt-mt798x
1
0
Fork 0
mirror of https://github.com/hanwckf/immortalwrt-mt798x.git synced 2025-01-08 10:23:47 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

mac80211: fix an uninitialized stack variable in the minstrel update

Browse Source 
It can lead to out-of-bounds access and invalid rates

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau 2021-01-14 20:12:08 +01:00
parent f841855f10
commit faeaf5a010
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
package/kernel/mac80211/patches/subsys/343-mac80211-minstrel_ht-fix-max-probability-rate-select.patch
View File

@ -76,7 +76,15 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
bool ht_supported = mi->sta->ht_cap.ht_supported;
mi->sample_mode = MINSTREL_SAMPLE_IDLE;
@@ -903,9 +913,6 @@ minstrel_ht_update_stats(struct minstrel
@@ -863,6 +873,7 @@ minstrel_ht_update_stats(struct minstrel
else
index = MINSTREL_OFDM_GROUP * MCS_GROUP_RATES;
+ tmp_max_prob_rate = index;
for (j = 0; j < ARRAY_SIZE(tmp_mcs_tp_rate); j++)
tmp_mcs_tp_rate[j] = index;
@@ -903,9 +914,6 @@ minstrel_ht_update_stats(struct minstrel
/* Find max throughput rate set within a group */
minstrel_ht_sort_best_tp_rates(mi, index,
tmp_group_tp_rate);
@ -86,7 +94,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
}
memcpy(mg->max_group_tp_rate, tmp_group_tp_rate,
@@ -917,6 +924,27 @@ minstrel_ht_update_stats(struct minstrel
@@ -917,6 +925,27 @@ minstrel_ht_update_stats(struct minstrel
tmp_legacy_tp_rate);
memcpy(mi->max_tp_rate, tmp_mcs_tp_rate, sizeof(mi->max_tp_rate));

2
package/kernel/mac80211/patches/subsys/344-mac80211-minstrel_ht-increase-stats-update-interval.patch
View File

@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -1864,7 +1864,7 @@ minstrel_ht_alloc(struct ieee80211_hw *h
@@ -1865,7 +1865,7 @@ minstrel_ht_alloc(struct ieee80211_hw *h
mp->has_mrr = true;
mp->hw = hw;