From: Pavel Roskin <proski@gnu.org>
Date: Sat, 11 Feb 2012 15:01:53 +0000 (-0500)
Subject: ath9k: stop on rates with idx -1 in ath9k rate control's .tx_status
X-Git-Tag: v3.2.9~17
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=72633f08ad74b93530b8e038041c450492a00ed5;p=pandora-kernel.git

ath9k: stop on rates with idx -1 in ath9k rate control's .tx_status

commit 2504a6423b9ab4c36df78227055995644de19edb upstream.

Rate control algorithms are supposed to stop processing when they
encounter a rate with the index -1.  Checking for rate->count not being
zero is not enough.

Allowing a rate with negative index leads to memory corruption in
ath_debug_stat_rc().

One consequence of the bug is discussed at
https://bugzilla.redhat.com/show_bug.cgi?id=768639

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

Reading git-diff-tree failed