linux-kernel - Re: [PATCH 2/2] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 29 Oct 2021 02:11:38 +0100
From:   Bryan O'Donoghue <bryan.odonoghue@...aro.org>
To:     Benjamin Li <benl@...areup.com>, Kalle Valo <kvalo@...eaurora.org>
Cc:     Loic Poulain <loic.poulain@...aro.org>,
        linux-arm-msm@...r.kernel.org,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, wcn36xx@...ts.infradead.org,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates

On 29/10/2021 01:39, Benjamin Li wrote:
> On 10/28/21 5:30 PM, Bryan O'Donoghue wrote:
>> On 28/10/2021 23:31, Benjamin Li wrote:
>>> -            status.rate_idx >= sband->n_bitrates) {
>> This fix was applied because we were getting a negative index
>>
>> If you want to remove that, you'll need to do something about this
>>
>> status.rate_idx -= 4;
> 
> Hmm... so you're saying there's a FW bug where sometimes we get
> bd->rate_id = 0-7 (leading to status.rate_idx = 0-3) on a 5GHz
> channel?

My memory is I saw a negative index as a result of the -4 offset but, it 
is quite some time ago and we have made all sorts of changes since.

> static const struct wcn36xx_rate wcn36xx_rate_table[] = {
>      /* 11b rates */
>      {  10, 0, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },
>      {  20, 1, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },
>      {  55, 2, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },
>      { 110, 3, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },
> 
>      /* 11b SP (short preamble) */
>      {  10, 0, RX_ENC_LEGACY, RX_ENC_FLAG_SHORTPRE, RATE_INFO_BW_20 },
>      {  20, 1, RX_ENC_LEGACY, RX_ENC_FLAG_SHORTPRE, RATE_INFO_BW_20 },
>      {  55, 2, RX_ENC_LEGACY, RX_ENC_FLAG_SHORTPRE, RATE_INFO_BW_20 },
>      { 110, 3, RX_ENC_LEGACY, RX_ENC_FLAG_SHORTPRE, RATE_INFO_BW_20 },
> 
> It sounds like we should WARN and drop the frame in that case. If
> you agree I'll send a v2.

So,

Let me see if I can replicate the previous bug - tomorrow - later this 
morning in fact - in this timezone, and I'll get back to you.

---
bod