From: Felix Fietkau <nbd@openwrt.org>
To: Konstantin Khlebnikov <koct9i@gmail.com>,
linux-wireless@vger.kernel.org,
Johannes Berg <johannes@sipsolutions.net>
Cc: Linux Kernel Network Developers <netdev@vger.kernel.org>,
Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Subject: Re: KASAN splal in minstrel_ht_update_stats()
Date: Thu, 28 Jan 2016 19:52:42 +0100 [thread overview]
Message-ID: <56AA637A.6030407@openwrt.org> (raw)
In-Reply-To: <CALYGNiNyJhSaVnE35qS6UCGaSb2Dx1_i5HcRavuOX14oTz2P+w@mail.gmail.com>
On 2016-01-15 06:23, Konstantin Khlebnikov wrote:
> Jan 10 17:56:25 hamm kernel: [184374.378842]
> ==================================================================
> Jan 10 17:56:25 hamm kernel: [184374.379001] BUG: KASAN:
> slab-out-of-bounds in minstrel_ht_update_stats.isra.7+0x6e1/0x9e0
[...]
> ==================================================================
>
> out-of-bound in
>
> if (mrs->prob_ewma > mg->rates[mg->max_group_prob_rate].prob_ewma)
> mg->max_group_prob_rate = index;
>
>
>
> Fix should be something like this:
>
> --- a/net/mac80211/rc80211_minstrel_ht.c
> +++ b/net/mac80211/rc80211_minstrel_ht.c
> @@ -414,15 +414,16 @@ minstrel_ht_set_best_prob_rate(struct
> minstrel_ht_sta *mi, u16 index)
> (max_tp_group != MINSTREL_CCK_GROUP))
> return;
>
> + max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
> + max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
> + max_gpr_prob = mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
> +
> if (mrs->prob_ewma > MINSTREL_FRAC(75, 100)) {
> cur_tp_avg = minstrel_ht_get_tp_avg(mi, cur_group, cur_idx,
> mrs->prob_ewma);
> if (cur_tp_avg > tmp_tp_avg)
> mi->max_prob_rate = index;
>
> - max_gpr_group = mg->max_group_prob_rate / MCS_GROUP_RATES;
> - max_gpr_idx = mg->max_group_prob_rate % MCS_GROUP_RATES;
> - max_gpr_prob =
> mi->groups[max_gpr_group].rates[max_gpr_idx].prob_ewma;
> max_gpr_tp_avg = minstrel_ht_get_tp_avg(mi, max_gpr_group,
> max_gpr_idx,
> max_gpr_prob);
> @@ -431,7 +432,7 @@ minstrel_ht_set_best_prob_rate(struct
> minstrel_ht_sta *mi, u16 index)
> } else {
> if (mrs->prob_ewma > tmp_prob)
> mi->max_prob_rate = index;
> - if (mrs->prob_ewma >
> mg->rates[mg->max_group_prob_rate].prob_ewma)
> + if (mrs->prob_ewma > max_gpr_prob)
> mg->max_group_prob_rate = index;
> }
> }
Fix looks correct, but does not apply (line wrapped). Please resubmit
with a proper description and your Signed-off-by.
Thanks,
- Felix
prev parent reply other threads:[~2016-01-28 18:52 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-15 5:23 KASAN splal in minstrel_ht_update_stats() Konstantin Khlebnikov
2016-01-28 18:52 ` Felix Fietkau [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56AA637A.6030407@openwrt.org \
--to=nbd@openwrt.org \
--cc=johannes@sipsolutions.net \
--cc=koct9i@gmail.com \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=thomas@net.t-labs.tu-berlin.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).