⬢ DragonFlyBSD Kernel Audit
DF-0730 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
diff --git a/sys/netproto/802_11/ieee80211_rssadapt.h b/sys/netproto/802_11/ieee80211_rssadapt.h
--- a/sys/netproto/802_11/ieee80211_rssadapt.h
+++ b/sys/netproto/802_11/ieee80211_rssadapt.h
@@ -61,9 +61,12 @@
 	uint32_t		ra_nok;
 	/* exponential average packets/second */
 	uint32_t		ra_pktrate;
-	/* RSSI threshold for each Tx rate */
+	/* RSSI threshold for each Tx rate.
+	 * Must be indexed by [0..rs_nrates-1]; rs_nrates can be up to
+	 * IEEE80211_RATE_MAXSIZE (15) once XRATES are merged, so the array
+	 * must be sized by RATE_MAXSIZE, not RATE_SIZE (8). */
 	uint16_t		ra_rate_thresh[IEEE80211_RSSADAPT_BKTS]
-					      [IEEE80211_RATE_SIZE];
+					      [IEEE80211_RATE_MAXSIZE];
 };
 
 #define	IEEE80211_RSSADAPT_SUCCESS	1
diff --git a/sys/netproto/802_11/wlan/ieee80211_rssadapt.c b/sys/netproto/802_11/wlan/ieee80211_rssadapt.c
--- a/sys/netproto/802_11/wlan/ieee80211_rssadapt.c
+++ b/sys/netproto/802_11/wlan/ieee80211_rssadapt.c
@@ -238,7 +238,7 @@
 	struct ieee80211_rssadapt_node *ra = ni->ni_rctls;
 	u_int pktlen = iarg;
 	const struct ieee80211_rateset *rs = &ra->ra_rates;
-	uint16_t (*thrs)[IEEE80211_RATE_SIZE];
+	uint16_t (*thrs)[IEEE80211_RATE_MAXSIZE];
 	int rix, rssi;
 
 	if ((ticks - ra->ra_ticks) > ra->ra_rs->interval) {
@@ -275,7 +275,7 @@
 rssadapt_lower_rate(struct ieee80211_rssadapt_node *ra, int pktlen, int rssi)
 {
 	uint16_t last_thr;
-	uint16_t (*thrs)[IEEE80211_RATE_SIZE];
+	uint16_t (*thrs)[IEEE80211_RATE_MAXSIZE];
 	u_int rix;
 
 	thrs = &ra->ra_rate_thresh[bucket(pktlen)];
@@ -294,7 +294,7 @@
 static void
 rssadapt_raise_rate(struct ieee80211_rssadapt_node *ra, int pktlen, int rssi)
 {
-	uint16_t (*thrs)[IEEE80211_RATE_SIZE];
+	uint16_t (*thrs)[IEEE80211_RATE_MAXSIZE];
 	uint16_t newthr, oldthr;
 	int rix;