This is a note to let you know that I've just added the patch titled
wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
to the 6.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
wifi-mt76-mt76x0-fix-oob-access-in-mt76x0_phy_get_ta.patch
and it can be found in the queue-6.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 37cfbe8106a32bf4ecf7e34ec8230232eafd32ab
Author: Lorenzo Bianconi <lorenzo@xxxxxxxxxx>
Date: Mon Dec 5 17:59:04 2022 +0100
wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
[ Upstream commit 6e1abc51c945663bddebfa1beb9590ff5b250eb7 ]
After 'commit ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct
mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for
vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}.
Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine.
Fixes: ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power")
Signed-off-by: Lorenzo Bianconi <lorenzo@xxxxxxxxxx>
Signed-off-by: Felix Fietkau <nbd@xxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
index 6c6c8ada7943b..d543ef3de65be 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
@@ -642,7 +642,12 @@ mt76x0_phy_get_target_power(struct mt76x02_dev *dev, u8 tx_mode,
if (tx_rate > 9)
return -EINVAL;
- *target_power = cur_power + dev->rate_power.vht[tx_rate];
+ *target_power = cur_power;
+ if (tx_rate > 7)
+ *target_power += dev->rate_power.vht[tx_rate - 8];
+ else
+ *target_power += dev->rate_power.ht[tx_rate];
+
*target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 1, tx_rate);
break;
default:
