Commit d874e6c0 authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Kalle Valo
Browse files

mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_report 



Fix possible array out of bound access in mt7921_mcu_tx_rate_report.
Remove unnecessary varibable in mt7921_mcu_tx_rate_report

Fixes: 1c099ab4 ("mt76: mt7921: add MCU support")
Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/91a1e8f6b6a3e6a929de560ed68132f6eb421720.1619187875.git.lorenzo@kernel.org
parent 6efb943b

drivers/net/wireless/mediatek/mt76/mt7921/mcu.c

+10 −7
Original line number Diff line number Diff line
@@ -402,20 +402,22 @@ static void 
mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb,

			  u16 wlan_idx)

{

	struct mt7921_mcu_wlan_info_event *wtbl_info =

		(struct mt7921_mcu_wlan_info_event *)(skb->data);

	struct rate_info rate = {};

	u8 curr_idx = wtbl_info->rate_info.rate_idx;

	u16 curr = le16_to_cpu(wtbl_info->rate_info.rate[curr_idx]);

	struct mt7921_mcu_peer_cap peer = wtbl_info->peer_cap;

	struct mt7921_mcu_wlan_info_event *wtbl_info;

	struct mt76_phy *mphy = &dev->mphy;

	struct mt7921_sta_stats *stats;

	struct rate_info rate = {};

	struct mt7921_sta *msta;

	struct mt76_wcid *wcid;

	u8 idx;



	if (wlan_idx >= MT76_N_WCIDS)

		return;



	wtbl_info = (struct mt7921_mcu_wlan_info_event *)skb->data;

	idx = wtbl_info->rate_info.rate_idx;

	if (idx >= ARRAY_SIZE(wtbl_info->rate_info.rate))

		return;



	rcu_read_lock();



	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
@@ -426,7 +428,8 @@ mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb, 
	stats = &msta->stats;



	/* current rate */

	mt7921_mcu_tx_rate_parse(mphy, &peer, &rate, curr);

	mt7921_mcu_tx_rate_parse(mphy, &wtbl_info->peer_cap, &rate,

				 le16_to_cpu(wtbl_info->rate_info.rate[idx]));

	stats->tx_rate = rate;

out:

	rcu_read_unlock();