diff options
author | Luciano Coelho <luciano.coelho@nokia.com> | 2009-07-03 01:25:08 -0400 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2009-07-07 12:55:28 -0400 |
commit | 3938b45c1c75e53d45eb65ac253f12e86239c9ba (patch) | |
tree | 9653bd914d6e117c4057f75d65ba61e30e6afa99 /net/mac80211/rc80211_minstrel.c | |
parent | 2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f (diff) |
mac80211: minstrel: avoid accessing negative indices in rix_to_ndx()
If rix is not found in mi->r[], i will become -1 after the loop. This value
is eventually used to access arrays, so we were accessing arrays with a
negative index, which is obviously not what we want to do. This patch fixes
this potential problem.
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Acked-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/rc80211_minstrel.c')
-rw-r--r-- | net/mac80211/rc80211_minstrel.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c index b218b98fba7f..37771abd8f5a 100644 --- a/net/mac80211/rc80211_minstrel.c +++ b/net/mac80211/rc80211_minstrel.c | |||
@@ -66,7 +66,7 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix) | |||
66 | for (i = rix; i >= 0; i--) | 66 | for (i = rix; i >= 0; i--) |
67 | if (mi->r[i].rix == rix) | 67 | if (mi->r[i].rix == rix) |
68 | break; | 68 | break; |
69 | WARN_ON(mi->r[i].rix != rix); | 69 | WARN_ON(i < 0); |
70 | return i; | 70 | return i; |
71 | } | 71 | } |
72 | 72 | ||
@@ -181,6 +181,9 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband, | |||
181 | break; | 181 | break; |
182 | 182 | ||
183 | ndx = rix_to_ndx(mi, ar[i].idx); | 183 | ndx = rix_to_ndx(mi, ar[i].idx); |
184 | if (ndx < 0) | ||
185 | continue; | ||
186 | |||
184 | mi->r[ndx].attempts += ar[i].count; | 187 | mi->r[ndx].attempts += ar[i].count; |
185 | 188 | ||
186 | if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0)) | 189 | if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0)) |