Felix Fietkau 280ba51d60 mac80211: minstrel_ht: fix a crash in rate sorting ...

The commit 5935839ad7
"mac80211: improve minstrel_ht rate sorting by throughput & probability"

introduced a crash on rate sorting that occurs when the rate added to
the sorting array is faster than all the previous rates. Due to an
off-by-one error, it reads the rate index from tp_list[-1], which
contains uninitialized stack garbage, and then uses the resulting index
for accessing the group rate stats, leading to a crash if the garbage
value is big enough.

Cc: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

2014-11-18 22:39:16 +01:00

..

aes_ccm.c

…

aes_ccm.h

…

aes_cmac.c

…

aes_cmac.h

…

agg-rx.c

…

agg-tx.c

…

cfg.c

…

cfg.h

…

chan.c

…

debug.h

…

debugfs_key.c

…

debugfs_key.h

…

debugfs_netdev.c

…

debugfs_netdev.h

…

debugfs_sta.c

…

debugfs_sta.h

…

debugfs.c

…

debugfs.h

…

driver-ops.h

…

ethtool.c

…

event.c

…

ht.c

…

ibss.c

…

ieee80211_i.h

…

iface.c

…

Kconfig

…

key.c

…

key.h

…

led.c

…

led.h

…

main.c

…

Makefile

…

mesh_hwmp.c

…

mesh_pathtbl.c

…

mesh_plink.c

…

mesh_ps.c

…

mesh_sync.c

…

mesh.c

…

mesh.h

…

michael.c

…

michael.h

…

mlme.c

…

offchannel.c

…

pm.c

…

rate.c

…

rate.h

…

rc80211_minstrel_debugfs.c

…

rc80211_minstrel_ht_debugfs.c

…

rc80211_minstrel_ht.c

…

rc80211_minstrel_ht.h

…

rc80211_minstrel.c

…

rc80211_minstrel.h

…

rx.c

…

scan.c

…

spectmgmt.c

…

sta_info.c

…

sta_info.h

…

status.c

…

tdls.c

…

tkip.c

…

tkip.h

…

trace.c

…

trace.h

…

tx.c

…

util.c

…

vht.c

…

wep.c

…

wep.h

…

wme.c

…

wme.h

…

wpa.c

…

wpa.h

…