This is a note to let you know that I've just added the patch titled
ath9k: stop on rates with idx -1 in ath9k rate control's .tx_status
to the 3.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch
and it can be found in the queue-3.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 2504a6423b9ab4c36df78227055995644de19edb Mon Sep 17 00:00:00 2001
From: Pavel Roskin <[email protected]>
Date: Sat, 11 Feb 2012 10:01:53 -0500
Subject: ath9k: stop on rates with idx -1 in ath9k rate control's .tx_status
From: Pavel Roskin <[email protected]>
commit 2504a6423b9ab4c36df78227055995644de19edb upstream.
Rate control algorithms are supposed to stop processing when they
encounter a rate with the index -1. Checking for rate->count not being
zero is not enough.
Allowing a rate with negative index leads to memory corruption in
ath_debug_stat_rc().
One consequence of the bug is discussed at
https://bugzilla.redhat.com/show_bug.cgi?id=768639
Signed-off-by: Pavel Roskin <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/wireless/ath/ath9k/rc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1347,7 +1347,7 @@ static void ath_tx_status(void *priv, st
fc = hdr->frame_control;
for (i = 0; i < sc->hw->max_rates; i++) {
struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
- if (!rate->count)
+ if (rate->idx < 0 || !rate->count)
break;
final_ts_idx = i;
Patches currently in stable-queue which might be from [email protected] are
queue-3.2/ath9k-stop-on-rates-with-idx-1-in-ath9k-rate-control-s-.tx_status.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
