diff options
| author | Lorenzo Bianconi <lorenzo@kernel.org> | 2021-11-18 11:42:06 +0100 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2021-12-19 15:23:59 +0100 |
| commit | d4f3d1c4d3c2bcce76a96a6562170664b25112f0 (patch) | |
| tree | 861c6d867ca17069d82f3a7cc4f14295f7de2950 /drivers/net/wireless/mediatek/mt76/mac80211.c | |
| parent | 7f96905068ab826b270b41d70d46e2849e5db7df (diff) | |
mt76: fix possible OOB issue in mt76_calculate_default_rate
Cap max offset value to ARRAY_SIZE(mt76_rates) - 1 in
mt76_calculate_default_rate routine in order to avoid possible Out Of
Bound accesses.
Fixes: 33920b2bf0483 ("mt76: add support for setting mcast rate")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers/net/wireless/mediatek/mt76/mac80211.c')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mac80211.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c index 62807dc311c1..b0869ff86c49 100644 --- a/drivers/net/wireless/mediatek/mt76/mac80211.c +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c @@ -1494,7 +1494,6 @@ EXPORT_SYMBOL_GPL(mt76_init_queue); u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx) { int offset = 0; - struct ieee80211_rate *rate; if (phy->chandef.chan->band != NL80211_BAND_2GHZ) offset = 4; @@ -1503,9 +1502,11 @@ u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx) if (rateidx < 0) rateidx = 0; - rate = &mt76_rates[offset + rateidx]; + rateidx += offset; + if (rateidx >= ARRAY_SIZE(mt76_rates)) + rateidx = offset; - return rate->hw_value; + return mt76_rates[rateidx].hw_value; } EXPORT_SYMBOL_GPL(mt76_calculate_default_rate); |