Commit 910570b5 authored Feb 01, 2012 by Dan Carpenter Committed by John W. Linville Feb 06, 2012

mac80211: off by one in mcs mask handling



"ridx" is used as an index into the mcs_mask[] array which has
IEEE80211_HT_MCS_MASK_LEN elements.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent d486a5b4

net/mac80211/rate.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -324,7 +324,7 @@ static bool rate_idx_match_mcs_mask(struct ieee80211_tx_rate *rate,
		rbit = rate->idx % 8;

		/* sanity check */
		if (ridx < 0 \|\| ridx > IEEE80211_HT_MCS_MASK_LEN)
		if (ridx < 0 \|\| ridx >= IEEE80211_HT_MCS_MASK_LEN)
		return false;

		/* See whether the selected rate or anything below it is allowed. */

net/wireless/nl80211.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -5410,7 +5410,7 @@ static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
		rbit = BIT(rates[i] % 8);

		/* check validity */
		if ((ridx < 0) \|\| (ridx > IEEE80211_HT_MCS_MASK_LEN))
		if ((ridx < 0) \|\| (ridx >= IEEE80211_HT_MCS_MASK_LEN))
		return false;

		/* check availability */