From 5598d891d36f4c6f79d6d14f579fc79825d0b637 Mon Sep 17 00:00:00 2001 From: Kai-Heng Feng Date: Wed, 18 May 2022 11:56:34 +0800 Subject: [PATCH] ath5k: Fix out-of-bound access Signed-off-by: Kai-Heng Feng --- drivers/net/wireless/ath/ath5k/base.c | 5 +++-- drivers/net/wireless/ath/ath5k/desc.c | 3 +++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c index 66d123f48085d..aa805e29ae90d 100644 --- a/drivers/net/wireless/ath/ath5k/base.c +++ b/drivers/net/wireless/ath/ath5k/base.c @@ -1730,7 +1730,7 @@ ath5k_tx_frame_completed(struct ath5k_hw *ah, struct sk_buff *skb, ieee80211_tx_info_clear_status(info); - for (i = 0; i < ts->ts_final_idx; i++) { + for (i = 0; i < 3 && i <= ts->ts_final_idx; i++) { struct ieee80211_tx_rate *r = &info->status.rates[i]; @@ -1738,7 +1738,8 @@ ath5k_tx_frame_completed(struct ath5k_hw *ah, struct sk_buff *skb, } info->status.rates[ts->ts_final_idx].count = ts->ts_final_retry; - info->status.rates[ts->ts_final_idx + 1].idx = -1; + if (ts->ts_final_idx + 1 < IEEE80211_TX_MAX_RATES) + info->status.rates[ts->ts_final_idx + 1].idx = -1; if (unlikely(ts->ts_status)) { ah->stats.ack_fail++; diff --git a/drivers/net/wireless/ath/ath5k/desc.c b/drivers/net/wireless/ath/ath5k/desc.c index 80f75139495fc..0d0b281d77fa4 100644 --- a/drivers/net/wireless/ath/ath5k/desc.c +++ b/drivers/net/wireless/ath/ath5k/desc.c @@ -528,6 +528,9 @@ ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah, ts->ts_final_idx = AR5K_REG_MS(txstat1, AR5K_DESC_TX_STATUS1_FINAL_TS_IX_5212); + ts->ts_final_idx = ts->ts_final_idx < IEEE80211_TX_MAX_RATES ?: + IEEE80211_TX_MAX_RATES - 1; + /* TX error */ if (!(txstat0 & AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK)) { if (txstat0 & AR5K_DESC_TX_STATUS0_EXCESSIVE_RETRIES) -- 2.34.1