Commit 2df1b131 authored by Johannes Berg's avatar Johannes Berg

mac80211: fix VHT MCS mask array overrun

The HT MCS mask has 9 bytes, the VHT one only has 8 streams.
Split the loops to handle this correctly.
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent ef9be10c
...@@ -2518,15 +2518,17 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy, ...@@ -2518,15 +2518,17 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
continue; continue;
for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) { for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) {
if (~sdata->rc_rateidx_mcs_mask[i][j]) if (~sdata->rc_rateidx_mcs_mask[i][j]) {
sdata->rc_has_mcs_mask[i] = true; sdata->rc_has_mcs_mask[i] = true;
break;
}
}
if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) for (j = 0; j < NL80211_VHT_NSS_MAX; j++) {
if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) {
sdata->rc_has_vht_mcs_mask[i] = true; sdata->rc_has_vht_mcs_mask[i] = true;
if (sdata->rc_has_mcs_mask[i] &&
sdata->rc_has_vht_mcs_mask[i])
break; break;
}
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment