| From b403f206062aee515c6d0fcabf327a87c7a04fbc Mon Sep 17 00:00:00 2001 |
| From: Peter Chiu <chui-hao.chiu@mediatek.com> |
| Date: Wed, 10 Apr 2024 14:05:12 +0800 |
| Subject: [PATCH 004/116] wifi: mt76: mt7996: use hweight16 to get correct |
| tx_ant |
| |
| The chainmask is u16 so using hweight8 cannot get correct tx_ant. |
| |
| Without this patch, the tx_ant of band 2 would be -1 and lead to |
| the following issue: |
| BUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e] |
| |
| Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> |
| CR-Id: WCNCR00240772 |
| Change-Id: I5ccd634431c6047371e687c7c4bb4f315f2c97e5 |
| --- |
| mt7996/mcu.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/mt7996/mcu.c b/mt7996/mcu.c |
| index 4f8e656b2..e426d0737 100644 |
| --- a/mt7996/mcu.c |
| +++ b/mt7996/mcu.c |
| @@ -1653,7 +1653,7 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb, |
| { |
| struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv; |
| struct mt7996_phy *phy = mvif->phy; |
| - int tx_ant = hweight8(phy->mt76->chainmask) - 1; |
| + int tx_ant = hweight16(phy->mt76->chainmask) - 1; |
| struct sta_rec_bf *bf; |
| struct tlv *tlv; |
| const u8 matrix[4][4] = { |
| -- |
| 2.39.2 |
| |