netdev - Re: [PATCH 4/4] mt76: mt7615: sync with mt7603 rate control changes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <ee49c064-1ea6-8262-7672-b91d1a9a037e@embeddedor.com>
Date:   Fri, 20 Sep 2019 18:44:31 -0500
From:   "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To:     Felix Fietkau <nbd@....name>, linux-wireless@...r.kernel.org,
        Lorenzo Bianconi <lorenzo.bianconi83@...il.com>,
        Roy Luo <royluo@...gle.com>, Kalle Valo <kvalo@...eaurora.org>,
        "David S. Miller" <davem@...emloft.net>,
        Matthias Brugger <matthias.bgg@...il.com>,
        Networking <netdev@...r.kernel.org>,
        linux-arm-kernel@...ts.infradead.org,
        linux-mediatek@...ts.infradead.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Ryder Lee <ryder.lee@...iatek.com>
Subject: Re: [PATCH 4/4] mt76: mt7615: sync with mt7603 rate control changes

Hi all,

On 7/4/19 10:53, Felix Fietkau wrote:
[..]
> +	for (i = 0, idx = first_idx; count && idx <= last_idx; idx++) {
> +		struct ieee80211_tx_rate *cur_rate;
> +		int cur_count;
>  
> -		info->status.rates[i].count = cur_count;
> -		final_idx = i;
> +		cur_rate = &rs->rates[idx / 2];
> +		cur_count = min_t(int, MT7615_RATE_RETRY, count);
>  		count -= cur_count;
> +
> +		if (idx && (cur_rate->idx != info->status.rates[i].idx ||
> +			    cur_rate->flags != info->status.rates[i].flags)) {
> +			i++;
> +			if (i == ARRAY_SIZE(info->status.rates))

Is this actually possible  ^^^^^^^ ?? in case it is, see my comments below...

> +				break;
> +
> +			info->status.rates[i] = *cur_rate;
> +			info->status.rates[i].count = 0;
> +		}
> +
> +		info->status.rates[i].count += cur_count;
>  	}
>  
>  out:
> -	final_rate_flags = info->status.rates[final_idx].flags;
> +	final_rate_flags = info->status.rates[i].flags;

There is an out-of-bounds access here........^^^ and see below...

>  
>  	switch (FIELD_GET(MT_TX_RATE_MODE, final_rate)) {
>  	case MT_PHY_TYPE_CCK:
> @@ -713,8 +778,8 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta,
>  		return false;
>  	}
>  
> -	info->status.rates[final_idx].idx = final_rate;
> -	info->status.rates[final_idx].flags = final_rate_flags;
> +	info->status.rates[i].idx = final_rate;
> +	info->status.rates[i].flags = final_rate_flags;

here too ............... ^^^^

>  
>  	return true;
>  }

--
Gustavo