diff options
| author | Lorenzo Bianconi <lorenzo@kernel.org> | 2022-12-05 17:59:04 +0100 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2022-12-09 16:45:39 +0100 |
| commit | 6e1abc51c945663bddebfa1beb9590ff5b250eb7 (patch) | |
| tree | 7196dac4328c7f6b1a6e8720be6692512f333f9d /drivers/net/wireless/mediatek/mt76/mt76x0 | |
| parent | 54ccb836ffb28eacba51b674cbe94cb5613f8441 (diff) | |
| download | linux-stable-6e1abc51c945663bddebfa1beb9590ff5b250eb7.tar.gz linux-stable-6e1abc51c945663bddebfa1beb9590ff5b250eb7.tar.bz2 linux-stable-6e1abc51c945663bddebfa1beb9590ff5b250eb7.zip | |
wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
After 'commit ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct
mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for
vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}.
Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine.
Fixes: ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers/net/wireless/mediatek/mt76/mt76x0')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/mt76x0/phy.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c index 6c6c8ada7943..d543ef3de65b 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c @@ -642,7 +642,12 @@ mt76x0_phy_get_target_power(struct mt76x02_dev *dev, u8 tx_mode, if (tx_rate > 9) return -EINVAL; - *target_power = cur_power + dev->rate_power.vht[tx_rate]; + *target_power = cur_power; + if (tx_rate > 7) + *target_power += dev->rate_power.vht[tx_rate - 8]; + else + *target_power += dev->rate_power.ht[tx_rate]; + *target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 1, tx_rate); break; default: |