aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLuciano Coelho <luciano.coelho@nokia.com>2009-07-03 01:25:08 -0400
committerJohn W. Linville <linville@tuxdriver.com>2009-07-07 12:55:28 -0400
commit3938b45c1c75e53d45eb65ac253f12e86239c9ba (patch)
tree9653bd914d6e117c4057f75d65ba61e30e6afa99
parent2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f (diff)
mac80211: minstrel: avoid accessing negative indices in rix_to_ndx()
If rix is not found in mi->r[], i will become -1 after the loop. This value is eventually used to access arrays, so we were accessing arrays with a negative index, which is obviously not what we want to do. This patch fixes this potential problem. Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Acked-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--net/mac80211/rc80211_minstrel.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index b218b98fba7f..37771abd8f5a 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -66,7 +66,7 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
66 for (i = rix; i >= 0; i--) 66 for (i = rix; i >= 0; i--)
67 if (mi->r[i].rix == rix) 67 if (mi->r[i].rix == rix)
68 break; 68 break;
69 WARN_ON(mi->r[i].rix != rix); 69 WARN_ON(i < 0);
70 return i; 70 return i;
71} 71}
72 72
@@ -181,6 +181,9 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
181 break; 181 break;
182 182
183 ndx = rix_to_ndx(mi, ar[i].idx); 183 ndx = rix_to_ndx(mi, ar[i].idx);
184 if (ndx < 0)
185 continue;
186
184 mi->r[ndx].attempts += ar[i].count; 187 mi->r[ndx].attempts += ar[i].count;
185 188
186 if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0)) 189 if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))