diff options
author | Bob Copeland <me@bobcopeland.com> | 2009-06-05 08:21:50 -0400 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2009-06-10 13:27:51 -0400 |
commit | 5ee58d7e6ad019675b4090582aec4fa1180d8703 (patch) | |
tree | 1f6cb14a99e1b629bf9dcba2879feaf62a463af5 /scripts | |
parent | 4d1d49858c0a5a4fb1be4bc7972754cd640245ba (diff) |
mac80211: fix minstrel single-rate memory corruption
The minstrel rate controller periodically looks up rate indexes in
a sampling table. When accessing a specific row and column, minstrel
correctly does a bounds check which, on the surface, appears to handle
the case where mi->n_rates < 2. However, mi->sample_idx is actually
defined as an unsigned, so the right hand side is taken to be a huge
positive number when negative, and the check will always fail.
Consequently, the RC will overrun the array and cause random memory
corruption when communicating with a peer that has only a single rate.
The max value of mi->sample_idx is around 25 so casting to int should
have no ill effects.
Without the change, uptime is a few minutes under load with an AP
that has a single hard-coded rate, and both the AP and STA could
potentially crash. With the change, both lasted 12 hours with a
steady load.
Thanks to Ognjen Maric for providing the single-rate clue so I could
reproduce this.
This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the
regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000).
Cc: stable@kernel.org
Reported-by: Sergey S. Kostyliov <rathamahata@gmail.com>
Reported-by: Ognjen Maric <ognjen.maric@gmail.com>
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions