Commit 6e1abc51 authored by Lorenzo Bianconi's avatar Lorenzo Bianconi Committed by Felix Fietkau
Browse files

wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power 



After 'commit ba45841c ("wifi: mt76: mt76x02: simplify struct
mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for
vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}.
Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine.

Fixes: ba45841c ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power")
Signed-off-by: default avatarLorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 54ccb836

drivers/net/wireless/mediatek/mt76/mt76x0/phy.c

+6 −1
Original line number Diff line number Diff line
@@ -642,7 +642,12 @@ mt76x0_phy_get_target_power(struct mt76x02_dev *dev, u8 tx_mode, 
		if (tx_rate > 9)

			return -EINVAL;



		*target_power = cur_power + dev->rate_power.vht[tx_rate];

		*target_power = cur_power;

		if (tx_rate > 7)

			*target_power += dev->rate_power.vht[tx_rate - 8];

		else

			*target_power += dev->rate_power.ht[tx_rate];



		*target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 1, tx_rate);

		break;

	default: