node_map has MAX_NODE_NUM entries. When a new IBSS peer arrives after
the map is full, ath6kl_ibss_map_epid() currently increments node_num
before rejecting the mapping. The failed request therefore leaves
node_num one larger than the array.
A later call walks node_map up to node_num while looking for an existing
peer, which can read beyond the array. Reject the new mapping before
advancing node_num.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/net/wireless/ath/ath6kl/txrx.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index 97fdac7237e2..3b0033431b29 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -67,10 +67,9 @@ static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,
}
if (ep_map == -1) {
- ep_map = ar->node_num;
- ar->node_num++;
- if (ar->node_num > MAX_NODE_NUM)
+ if (ar->node_num >= MAX_NODE_NUM)
return ENDPOINT_UNUSED;
+ ep_map = ar->node_num++;
}
memcpy(ar->node_map[ep_map].mac_addr, eth_hdr->h_dest, ETH_ALEN);
--
2.43.0