Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2df1b131 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: fix VHT MCS mask array overrun 



The HT MCS mask has 9 bytes, the VHT one only has 8 streams.
Split the loops to handle this correctly.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent ef9be10c

net/mac80211/cfg.c

+7 −5
Original line number Diff line number Diff line
@@ -2518,17 +2518,19 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, 
			continue;



		for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) {

			if (~sdata->rc_rateidx_mcs_mask[i][j])

			if (~sdata->rc_rateidx_mcs_mask[i][j]) {

				sdata->rc_has_mcs_mask[i] = true;

				break;

			}

		}



			if (~sdata->rc_rateidx_vht_mcs_mask[i][j])

		for (j = 0; j < NL80211_VHT_NSS_MAX; j++) {

			if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) {

				sdata->rc_has_vht_mcs_mask[i] = true;



			if (sdata->rc_has_mcs_mask[i] &&

			    sdata->rc_has_vht_mcs_mask[i])

				break;

			}

		}

	}



	return 0;

}