Commit e8b970c8 authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Felix Fietkau
Browse files

mt76: fix possible out-of-bound access in mt7615_fill_txs/mt7603_fill_txs 



Fix possible out-of-bound access of status rates array in
mt7615_fill_txs/mt7603_fill_txs routines

Fixes: c5211e99 ("mt76: mt7603: rework and fix tx status reporting")
Fixes: 4af81f02 ("mt76: mt7615: sync with mt7603 rate control changes")
Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 45876d6e

drivers/net/wireless/mediatek/mt76/mt7603/mac.c

+3 −1
Original line number Diff line number Diff line
@@ -1136,8 +1136,10 @@ mt7603_fill_txs(struct mt7603_dev *dev, struct mt7603_sta *sta, 
		if (idx && (cur_rate->idx != info->status.rates[i].idx ||

			    cur_rate->flags != info->status.rates[i].flags)) {

			i++;

			if (i == ARRAY_SIZE(info->status.rates))

			if (i == ARRAY_SIZE(info->status.rates)) {

				i--;

				break;

			}



			info->status.rates[i] = *cur_rate;

			info->status.rates[i].count = 0;

drivers/net/wireless/mediatek/mt76/mt7615/mac.c

+3 −1
Original line number Diff line number Diff line
@@ -1039,8 +1039,10 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta, 
		if (idx && (cur_rate->idx != info->status.rates[i].idx ||

			    cur_rate->flags != info->status.rates[i].flags)) {

			i++;

			if (i == ARRAY_SIZE(info->status.rates))

			if (i == ARRAY_SIZE(info->status.rates)) {

				i--;

				break;

			}



			info->status.rates[i] = *cur_rate;

			info->status.rates[i].count = 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE