node_map has MAX_NODE_NUM entries. When a new peer arrives after the
map is full, ath6kl_ibss_map_epid() increments node_num before rejecting
the mapping. A later lookup then walks one element beyond node_map.
Reject a new mapping before advancing node_num.
Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v1: https://lore.kernel.org/all/20260722040721.74876-1-pengpeng@iscas.ac.cn/
- rebase on current ath6kl sources
- reject a full map before incrementing node_num
The IBSS map state transitions were reviewed statically; no ath6kl hardware
test was performed.
drivers/net/wireless/ath/ath6kl/txrx.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index d81825413906..b340c795b7a3 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -67,10 +67,9 @@ static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,
}
if (ep_map == -1) {
- ep_map = ar->node_num;
- ar->node_num++;
- if (ar->node_num > MAX_NODE_NUM)
+ if (ar->node_num >= MAX_NODE_NUM)
return ENDPOINT_UNUSED;
+ ep_map = ar->node_num++;
}
memcpy(ar->node_map[ep_map].mac_addr, eth_hdr->h_dest, ETH_ALEN);
--
2.50.1 (Apple Git-155)