lkml.org 
[lkml]   [2009]   [Jun]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 062/108] mac80211: fix minstrel single-rate memory corruption
    2.6.30-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Bob Copeland <me@bobcopeland.com>

    commit 5ee58d7e6ad019675b4090582aec4fa1180d8703 upstream.

    The minstrel rate controller periodically looks up rate indexes in
    a sampling table. When accessing a specific row and column, minstrel
    correctly does a bounds check which, on the surface, appears to handle
    the case where mi->n_rates < 2. However, mi->sample_idx is actually
    defined as an unsigned, so the right hand side is taken to be a huge
    positive number when negative, and the check will always fail.

    Consequently, the RC will overrun the array and cause random memory
    corruption when communicating with a peer that has only a single rate.
    The max value of mi->sample_idx is around 25 so casting to int should
    have no ill effects.

    Without the change, uptime is a few minutes under load with an AP
    that has a single hard-coded rate, and both the AP and STA could
    potentially crash. With the change, both lasted 12 hours with a
    steady load.

    Thanks to Ognjen Maric for providing the single-rate clue so I could
    reproduce this.

    This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the
    regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000).

    Reported-by: Sergey S. Kostyliov <rathamahata@gmail.com>
    Reported-by: Ognjen Maric <ognjen.maric@gmail.com>
    Signed-off-by: Bob Copeland <me@bobcopeland.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/mac80211/rc80211_minstrel.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/mac80211/rc80211_minstrel.c
    +++ b/net/mac80211/rc80211_minstrel.c
    @@ -216,7 +216,7 @@ minstrel_get_next_sample(struct minstrel
    unsigned int sample_ndx;
    sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column);
    mi->sample_idx++;
    - if (mi->sample_idx > (mi->n_rates - 2)) {
    + if ((int) mi->sample_idx > (mi->n_rates - 2)) {
    mi->sample_idx = 0;
    mi->sample_column++;
    if (mi->sample_column >= SAMPLE_COLUMNS)



    \
     
     \ /
      Last update: 2009-07-01 03:33    [W:4.146 / U:0.896 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site