[lvc-project] [PATCH 5.10] wifi: iwlwifi: add a few rate index validity checks

[Greg Kroah-Hartman]

On Tue, Jan 28, 2025 at 12:58:02PM +0300, Dmitry Antipov wrote:
> From: Anjaneyulu <pagadala.yesu.anjaneyulu at intel.com>
> 
> commit efbe8f81952fe469d38655744627d860879dcde8 upstream.
> 
> Validate index before access iwl_rate_mcs to keep rate->index
> inside the valid boundaries. Use MCS_0_INDEX if index is less
> than MCS_0_INDEX and MCS_9_INDEX if index is greater than
> MCS_9_INDEX.
> 
> Signed-off-by: Anjaneyulu <pagadala.yesu.anjaneyulu at intel.com>
> Signed-off-by: Gregory Greenman <gregory.greenman at intel.com>
> Link: https://lore.kernel.org/r/20230614123447.79f16b3aef32.If1137f894775d6d07b78cbf3a6163ffce6399507@changeid
> Signed-off-by: Johannes Berg <johannes.berg at intel.com>
> Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
> ---
>  drivers/net/wireless/intel/iwlwifi/dvm/rs.c |  9 ++++++---
>  drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 12 ++++++++----
>  2 files changed, 14 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rs.c b/drivers/net/wireless/intel/iwlwifi/dvm/rs.c
> index 548540dd0c0f..a2b477bc574a 100644
> --- a/drivers/net/wireless/intel/iwlwifi/dvm/rs.c
> +++ b/drivers/net/wireless/intel/iwlwifi/dvm/rs.c
> @@ -2,7 +2,7 @@
>  /******************************************************************************
>   *
>   * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
> - * Copyright (C) 2019 - 2020 Intel Corporation
> + * Copyright (C) 2019 - 2020, 2023 Intel Corporation
>   *
>   * Contact Information:
>   *  Intel Linux Wireless <linuxwifi at intel.com>
> @@ -130,7 +130,7 @@ static int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
>  				return idx;
>  	}
>  
> -	return -1;
> +	return IWL_RATE_INVALID;
>  }
>  
>  static void rs_rate_scale_perform(struct iwl_priv *priv,
> @@ -3151,7 +3151,10 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
>  	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
>  		index = iwl_hwrate_to_plcp_idx(
>  			le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags));
> -		if (is_legacy(tbl->lq_type)) {
> +		if (index == IWL_RATE_INVALID) {
> +			desc += sprintf(buff + desc, " rate[%d] 0x%X invalid rate\n",
> +				i, le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags));
> +		} else if (is_legacy(tbl->lq_type)) {
>  			desc += sprintf(buff+desc, " rate[%d] 0x%X %smbps\n",
>  				i, le32_to_cpu(lq_sta->lq.rs_table[i].rate_n_flags),
>  				iwl_rate_mcs[index].mbps);
> diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
> index ed7382e7ea17..0a9634d9006c 100644
> --- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
> +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
> @@ -1,7 +1,8 @@
>  // SPDX-License-Identifier: GPL-2.0-only
>  /******************************************************************************
>   *
> - * Copyright(c) 2005 - 2014, 2018 - 2020 Intel Corporation. All rights reserved.
> + * Copyright(c) 2005 - 2014, 2018 - 2020, 2023 Intel Corporation.
> + * All rights reserved.

Same here, why?

Also, what about 5.15.y?

thanks,

greg k-h