Commit d4f3d1c4 authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Felix Fietkau
Browse files

mt76: fix possible OOB issue in mt76_calculate_default_rate 



Cap max offset value to ARRAY_SIZE(mt76_rates) - 1 in
mt76_calculate_default_rate routine in order to avoid possible Out Of
Bound accesses.

Fixes: 33920b2b ("mt76: add support for setting mcast rate")
Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 7f969050

drivers/net/wireless/mediatek/mt76/mac80211.c

+4 −3
Original line number Diff line number Diff line
@@ -1494,7 +1494,6 @@ EXPORT_SYMBOL_GPL(mt76_init_queue); 
u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx)

{

	int offset = 0;

	struct ieee80211_rate *rate;



	if (phy->chandef.chan->band != NL80211_BAND_2GHZ)

		offset = 4;
@@ -1503,9 +1502,11 @@ u16 mt76_calculate_default_rate(struct mt76_phy *phy, int rateidx) 
	if (rateidx < 0)

		rateidx = 0;



	rate = &mt76_rates[offset + rateidx];

	rateidx += offset;

	if (rateidx >= ARRAY_SIZE(mt76_rates))

		rateidx = offset;



	return rate->hw_value;

	return mt76_rates[rateidx].hw_value;

}

EXPORT_SYMBOL_GPL(mt76_calculate_default_rate);