Skip to content
  • Karl Beldan's avatar
    mac80211: minstrels: fix buffer overflow in HT debugfs rc_stats · 11b2357d
    Karl Beldan authored
    
    
    ATM an HT rc_stats line is 106 chars.
    Times 8(MCS_GROUP_RATES)*3(SS)*2(GI)*2(BW) + CCK(4), i.e. x100, this is
    well above the current 8192 - sizeof(*ms) currently allocated.
    
    Fix this by squeezing the output as follows (not that we're short on
    memory but this also improves readability and range, the new format adds
    one more digit to *ok/*cum and ok/cum):
    
    - Before (HT) (106 ch):
    type           rate     throughput  ewma prob   this prob  retry   this succ/attempt   success    attempts
    CCK/LP          5.5M           0.0        0.0         0.0      0              0(  0)         0           0
    HT20/LGI ABCDP MCS0            0.0        0.0         0.0      1              0(  0)         0           0
    - After (75 ch):
    type           rate     tpt eprob *prob ret  *ok(*cum)        ok(      cum)
    CCK/LP          5.5M    0.0   0.0   0.0   0    0(   0)         0(        0)
    HT20/LGI ABCDP MCS0     0.0   0.0   0.0   1    0(   0)         0(        0)
    
    - Align non-HT format Before (non-HT) (83 ch):
    rate      throughput  ewma prob  this prob  this succ/attempt   success    attempts
    ABCDP  6         0.0        0.0        0.0             0(  0)         0           0
          54         0.0        0.0        0.0             0(  0)         0           0
    - After (61 ch):
    rate          tpt eprob *prob  *ok(*cum)        ok(      cum)
    ABCDP  1      0.0   0.0   0.0    0(   0)         0(        0)
          54      0.0   0.0   0.0    0(   0)         0(        0)
    
    *This also adds dynamic checks for overflow, lowers the size of the
    non-HT request (allowing > 30 entries) and replaces the buddy-rounded
    allocations (s/sizeof(*ms) + 8192/8192).
    
    Signed-off-by: default avatarKarl Beldan <karl.beldan@rivierawaves.com>
    Acked-by: default avatarFelix Fietkau <nbd@openwrt.org>
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    11b2357d