Re: [PATCH 1/2] ath9k: Fix kernel panic caused by invalid rate index access.

[Helmut Schaa <helmut.schaa@googlemail.com>]

Hi,

Am Mittwoch, 23. März 2011 schrieb Senthil Balasubramanian:
> With the recent tx status optimization in mac80211, we bail out as
> and and when invalid rate index is found. So the behavior of resetting
> rate idx to -1 and count to 0 has changed for the rate indexes that
> were not part of the driver's retry series.
> 
> This has resulted in ath9k using incorrect rate table index which
> caused the system to panic. Ideally ath9k need to loop only for the
> indexes that were part of the retry series and so simply use hw->max_rates
> as the loop counter.

Sorry for the trouble. I didn't consider rc algorithms
outside of net/mac80211/ ...

> ---
>  drivers/net/wireless/ath/ath9k/rc.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
> index 960d717..a3241cd 100644
> --- a/drivers/net/wireless/ath/ath9k/rc.c
> +++ b/drivers/net/wireless/ath/ath9k/rc.c
> @@ -1328,7 +1328,7 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
>  
>  	hdr = (struct ieee80211_hdr *)skb->data;
>  	fc = hdr->frame_control;
> -	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
> +	for (i = 0; i < sc->hw->max_rates; i++) {
>  		struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
>  		if (!rate->count)
>  			break;

You could also just change that check to

	if (rate->idx < 0)
		break;

instead as mac80211 already assumes the tx status rates array is terminated
by the driver by setting the idx to -1.

Helmut