From 58d16d9fe2d5a209cf22823359a8407d138e1a87 Mon Sep 17 00:00:00 2001 From: Adrien Destugues Date: Mon, 5 Aug 2019 18:49:46 +0200 Subject: [PATCH] rt2860: fix off-by-two access To be upstreamed to FreeBSD? Change-Id: Ia4389f4964429f80025003f97792b1ecd1097193 Reviewed-on: https://review.haiku-os.org/c/1681 Reviewed-by: Rene Gollent --- .../kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860.c | 5 ++++- .../drivers/network/wlan/ralinkwifi/dev/ral/rt2860var.h | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/add-ons/kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860.c b/src/add-ons/kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860.c index 6b5cce6364..2ff59ce6aa 100644 --- a/src/add-ons/kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860.c +++ b/src/add-ons/kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860.c @@ -1094,10 +1094,13 @@ rt2860_drain_stats_fifo(struct rt2860_softc *sc) DPRINTFN(4, ("tx stat 0x%08x\n", stat)); wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff; + if (wcid == 0xFF) + continue; + ni = sc->wcid2ni[wcid]; /* if no ACK was requested, no feedback is available */ - if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff || ni == NULL) + if (!(stat & RT2860_TXQ_ACKREQ) || ni == NULL) continue; /* update per-STA AMRR stats */ diff --git a/src/add-ons/kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860var.h b/src/add-ons/kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860var.h index f5ef90bc12..41eaa7f301 100644 --- a/src/add-ons/kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860var.h +++ b/src/add-ons/kernel/drivers/network/wlan/ralinkwifi/dev/ral/rt2860var.h @@ -142,7 +142,7 @@ struct rt2860_softc { #define RT2860_PCIE (1 << 2) #define RT2860_RUNNING (1 << 3) - struct ieee80211_node *wcid2ni[RT2860_WCID_MAX]; + struct ieee80211_node *wcid2ni[RT2860_WCID_MAX + 1]; struct rt2860_tx_ring txq[6]; struct rt2860_rx_ring rxq;