Messages in this thread Patch in this message | | | From | Greg Kroah-Hartman <> | Subject | [PATCH 40/97] iwmc3200wifi: fix array out-of-boundary access | Date | Mon, 4 Jan 2010 16:32:53 -0800 |
| |
From: Zhu Yi <yi.zhu@intel.com>
commit 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 upstream.
Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().
Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- drivers/net/wireless/iwmc3200wifi/iwm.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h index 1b02a4e..93c8989 100644 --- a/drivers/net/wireless/iwmc3200wifi/iwm.h +++ b/drivers/net/wireless/iwmc3200wifi/iwm.h @@ -258,7 +258,7 @@ struct iwm_priv { struct sk_buff_head rx_list; struct list_head rx_tickets; - struct list_head rx_packets[IWM_RX_ID_HASH]; + struct list_head rx_packets[IWM_RX_ID_HASH + 1]; struct workqueue_struct *rx_wq; struct work_struct rx_worker; -- 1.6.6
| |