Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2df1b131 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: fix VHT MCS mask array overrun



The HT MCS mask has 9 bytes, the VHT one only has 8 streams.
Split the loops to handle this correctly.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent ef9be10c
Loading
Loading
Loading
Loading
+7 −5
Original line number Diff line number Diff line
@@ -2518,17 +2518,19 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
			continue;

		for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) {
			if (~sdata->rc_rateidx_mcs_mask[i][j])
			if (~sdata->rc_rateidx_mcs_mask[i][j]) {
				sdata->rc_has_mcs_mask[i] = true;
				break;
			}
		}

			if (~sdata->rc_rateidx_vht_mcs_mask[i][j])
		for (j = 0; j < NL80211_VHT_NSS_MAX; j++) {
			if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) {
				sdata->rc_has_vht_mcs_mask[i] = true;

			if (sdata->rc_has_mcs_mask[i] &&
			    sdata->rc_has_vht_mcs_mask[i])
				break;
			}
		}
	}

	return 0;
}