[Bug 299248] iwlwifi: out-of-bounds access in iwl_mvm_ack_rates()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299248

--- Comment #4 from Mark Johnston <markj@FreeBSD.org> ---
(In reply to Bjoern A. Zeeb from comment #3)
Not directly, a lot of variables are optimized out. :(

But from frame 7 I can get it:

(kgdb)  p link_info->phy_ctxt->channel->band
$14 = NL80211_BAND_5GHZ
(kgdb) p *mvm->hw->wiphy->bands[NL80211_BAND_5GHZ]
$15 = {
  channels = 0xfffffe01ff7c3710,
  bitrates = 0xffffffff871b9db0 <iwl_cfg80211_rates+48>,
  iftype_data = 0x0,
  n_channels = 37,
  n_bitrates = 8,
  n_iftype_data = 0,
  band = NL80211_BAND_5GHZ,
  ht_cap = {
    ht_supported = true,
    ampdu_density = 5 '\005',
    ampdu_factor = 0 '\000',
    cap = 6627,
    mcs = {
      rx_mask = "\377\377\000\000\000\000\000\000\000",
      rx_highest = 300,
      tx_params = 1 '\001',
      __reserved = "\000\000"
    }
  },
  vht_cap = {
    vht_supported = true,
    cap = 59798006,
    vht_mcs = {
      rx_mcs_map = 65530,
      rx_highest = 0,
      tx_mcs_map = 65530,
      tx_highest = 8192
    }
  }
}

n_bitrates = 8, so I guess we are one past the end of the array.

-- 
You are receiving this mail because:
You are the assignee for the bug.