From: Felix Fietkau <nbd@openwrt.org>
Date: Tue, 18 Nov 2014 21:35:31 +0000 (+0100)
Subject: mac80211: minstrel_ht: fix a crash in rate sorting
X-Git-Tag: omap-for-v3.19/fixes-for-merge-window~83^2~4^2~1^2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=280ba51d60be6f4ca3347eaa60783314f38df72e;p=pandora-kernel.git

mac80211: minstrel_ht: fix a crash in rate sorting

The commit 5935839ad73583781b8bbe8d91412f6826e218a4
"mac80211: improve minstrel_ht rate sorting by throughput & probability"

introduced a crash on rate sorting that occurs when the rate added to
the sorting array is faster than all the previous rates. Due to an
off-by-one error, it reads the rate index from tp_list[-1], which
contains uninitialized stack garbage, and then uses the resulting index
for accessing the group rate stats, leading to a crash if the garbage
value is big enough.

Cc: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---

Reading git-diff-tree failed