diff for duplicates of <20120206175702.3a41ffc4@mj> diff --git a/a/1.txt b/N1/1.txt index 7cb66dc..0e3ebff 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -52,10 +52,3 @@ Fedora. -- Regards, Pavel Roskin --------------- next part -------------- -A non-text attachment was scrubbed... -Name: 01-rix-check.patch -Type: text/x-patch -Size: 1280 bytes -Desc: not available -Url : http://lists.ath9k.org/pipermail/ath9k-devel/attachments/20120206/721598be/attachment.bin diff --git a/N1/2.hdr b/N1/2.hdr new file mode 100644 index 0000000..2fdaaf5 --- /dev/null +++ b/N1/2.hdr @@ -0,0 +1,3 @@ +Content-Type: text/x-patch +Content-Transfer-Encoding: 7bit +Content-Disposition: attachment; filename=01-rix-check.patch diff --git a/N1/2.txt b/N1/2.txt new file mode 100644 index 0000000..d25b906 --- /dev/null +++ b/N1/2.txt @@ -0,0 +1,42 @@ +Prevent memory corruption in ath9k rate control algorithm + +From: Pavel Roskin <proski@gnu.org> + +Check final_rate in ath_debug_stat_rc(). Don't return negative values +from ath_rc_get_rateindex(), callers don't expect it. + +Signed-off-by: Pavel Roskin <proski@gnu.org> +--- + + drivers/net/wireless/ath/ath9k/rc.c | 10 ++++++++++ + 1 files changed, 10 insertions(+), 0 deletions(-) + + +diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c +index 635b592..afe22f4 100644 +--- a/drivers/net/wireless/ath/ath9k/rc.c ++++ b/drivers/net/wireless/ath/ath9k/rc.c +@@ -385,6 +385,11 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table, + int rix = 0, i = 0; + static const int mcs_rix_off[] = { 7, 15, 20, 21, 22, 23 }; + ++ if (rate->idx < 0) { ++ printk(KERN_ERR "%s: rate->idx = %d\n", __func__, rate->idx); ++ return 0; ++ } ++ + if (!(rate->flags & IEEE80211_TX_RC_MCS)) + return rate->idx; + +@@ -1324,6 +1329,11 @@ static void ath_debug_stat_rc(struct ath_rate_priv *rc, int final_rate) + { + struct ath_rc_stats *stats; + ++ if (final_rate < 0 || final_rate >= RATE_TABLE_SIZE) { ++ printk(KERN_ERR "%s: invalid final_rate: %d\n", __func__, ++ final_rate); ++ return; ++ } + stats = &rc->rcstats[final_rate]; + stats->success++; + } diff --git a/a/content_digest b/N1/content_digest index c3e6710..b9117b0 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,9 +1,12 @@ "ref\020120206002907.GA1899@Pilar.site\0" "From\0Pavel Roskin <proski@gnu.org>\0" - "Subject\0[ath9k-devel] [3.3-rc2+] Thousands of ath9k warnings on dmesg before laptop froze\0" + "Subject\0Re: [ath9k-devel] [3.3-rc2+] Thousands of ath9k warnings on dmesg before laptop froze\0" "Date\0Mon, 6 Feb 2012 17:57:02 -0500\0" - "To\0ath9k-devel@lists.ath9k.org\0" - "\00:1\0" + "To\0Carlos R. Mafra <crmafra@gmail.com>\0" + "Cc\0LKML <linux-kernel@vger.kernel.org>" + Luis R. Rodriguez <mcgrof@qca.qualcomm.com> + " ath9k-devel@venema.h4ckr.net\0" + "\01:1\0" "b\0" "On Mon, 6 Feb 2012 00:29:07 +0000\n" "\"Carlos R. Mafra\" <crmafra@gmail.com> wrote:\n" @@ -58,13 +61,51 @@ "\n" "-- \n" "Regards,\n" - "Pavel Roskin\n" - "-------------- next part --------------\n" - "A non-text attachment was scrubbed...\n" - "Name: 01-rix-check.patch\n" - "Type: text/x-patch\n" - "Size: 1280 bytes\n" - "Desc: not available\n" - Url : http://lists.ath9k.org/pipermail/ath9k-devel/attachments/20120206/721598be/attachment.bin + Pavel Roskin + "\01:2\0" + "fn\001-rix-check.patch\0" + "b\0" + "Prevent memory corruption in ath9k rate control algorithm\n" + "\n" + "From: Pavel Roskin <proski@gnu.org>\n" + "\n" + "Check final_rate in ath_debug_stat_rc(). Don't return negative values\n" + "from ath_rc_get_rateindex(), callers don't expect it.\n" + "\n" + "Signed-off-by: Pavel Roskin <proski@gnu.org>\n" + "---\n" + "\n" + " drivers/net/wireless/ath/ath9k/rc.c | 10 ++++++++++\n" + " 1 files changed, 10 insertions(+), 0 deletions(-)\n" + "\n" + "\n" + "diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c\n" + "index 635b592..afe22f4 100644\n" + "--- a/drivers/net/wireless/ath/ath9k/rc.c\n" + "+++ b/drivers/net/wireless/ath/ath9k/rc.c\n" + "@@ -385,6 +385,11 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,\n" + " \tint rix = 0, i = 0;\n" + " \tstatic const int mcs_rix_off[] = { 7, 15, 20, 21, 22, 23 };\n" + " \n" + "+\tif (rate->idx < 0) {\n" + "+\t\tprintk(KERN_ERR \"%s: rate->idx = %d\\n\", __func__, rate->idx);\n" + "+\t\treturn 0;\n" + "+\t}\n" + "+\n" + " \tif (!(rate->flags & IEEE80211_TX_RC_MCS))\n" + " \t\treturn rate->idx;\n" + " \n" + "@@ -1324,6 +1329,11 @@ static void ath_debug_stat_rc(struct ath_rate_priv *rc, int final_rate)\n" + " {\n" + " \tstruct ath_rc_stats *stats;\n" + " \n" + "+\tif (final_rate < 0 || final_rate >= RATE_TABLE_SIZE) {\n" + "+\t\tprintk(KERN_ERR \"%s: invalid final_rate: %d\\n\", __func__,\n" + "+\t\t final_rate);\n" + "+\t\treturn;\n" + "+\t}\n" + " \tstats = &rc->rcstats[final_rate];\n" + " \tstats->success++;\n" + } -9c747a3320f7a37cc29bede099893024add2f230de507340df79b4dc336d0823 +3ffa8acc0e947eb5d2cb28998e9f8349aebec4ae014a2463c47b3ec2832d04c8
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.