Commit 3938b45c authored Jul 03, 2009 by Luciano Coelho Committed by John W. Linville Jul 07, 2009

mac80211: minstrel: avoid accessing negative indices in rix_to_ndx()



If rix is not found in mi->r[], i will become -1 after the loop.  This value
is eventually used to access arrays, so we were accessing arrays with a
negative index, which is obviously not what we want to do.  This patch fixes
this potential problem.

Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Acked-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent 2dce4c2b

net/mac80211/rc80211_minstrel.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -66,7 +66,7 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
		for (i = rix; i >= 0; i--)
		if (mi->r[i].rix == rix)
		break;
		WARN_ON(mi->r[i].rix != rix);
		WARN_ON(i < 0);
		return i;
		}

		@@ -181,6 +181,9 @@ minstrel_tx_status(void priv, struct ieee80211_supported_band sband,
		break;

		ndx = rix_to_ndx(mi, ar[i].idx);
		if (ndx < 0)
		continue;

		mi->r[ndx].attempts += ar[i].count;

		if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))