linux-kernel - Re: [PATCH 2/2] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Oct 2021 17:39:58 -0700
From:   Benjamin Li <benl@...areup.com>
To:     Bryan O'Donoghue <bryan.odonoghue@...aro.org>,
        Kalle Valo <kvalo@...eaurora.org>
Cc:     Loic Poulain <loic.poulain@...aro.org>,
        linux-arm-msm@...r.kernel.org,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, wcn36xx@...ts.infradead.org,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates

On 10/28/21 5:30 PM, Bryan O'Donoghue wrote:
> On 28/10/2021 23:31, Benjamin Li wrote:
>> -            status.rate_idx >= sband->n_bitrates) {
> This fix was applied because we were getting a negative index
> 
> If you want to remove that, you'll need to do something about this
> 
> status.rate_idx -= 4;

Hmm... so you're saying there's a FW bug where sometimes we get
bd->rate_id = 0-7 (leading to status.rate_idx = 0-3) on a 5GHz
channel?

static const struct wcn36xx_rate wcn36xx_rate_table[] = {
    /* 11b rates */
    {  10, 0, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },
    {  20, 1, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },
    {  55, 2, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },
    { 110, 3, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },

    /* 11b SP (short preamble) */
    {  10, 0, RX_ENC_LEGACY, RX_ENC_FLAG_SHORTPRE, RATE_INFO_BW_20 },
    {  20, 1, RX_ENC_LEGACY, RX_ENC_FLAG_SHORTPRE, RATE_INFO_BW_20 },
    {  55, 2, RX_ENC_LEGACY, RX_ENC_FLAG_SHORTPRE, RATE_INFO_BW_20 },
    { 110, 3, RX_ENC_LEGACY, RX_ENC_FLAG_SHORTPRE, RATE_INFO_BW_20 },

It sounds like we should WARN and drop the frame in that case. If
you agree I'll send a v2.

> 
> ---
> bod