lkml.org 
[lkml]   [2010]   [Jan]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 40/97] iwmc3200wifi: fix array out-of-boundary access
    Date
    From: Zhu Yi <yi.zhu@intel.com>

    commit 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 upstream.

    Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
    index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().

    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ---
    drivers/net/wireless/iwmc3200wifi/iwm.h | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
    index 1b02a4e..93c8989 100644
    --- a/drivers/net/wireless/iwmc3200wifi/iwm.h
    +++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
    @@ -258,7 +258,7 @@ struct iwm_priv {

    struct sk_buff_head rx_list;
    struct list_head rx_tickets;
    - struct list_head rx_packets[IWM_RX_ID_HASH];
    + struct list_head rx_packets[IWM_RX_ID_HASH + 1];
    struct workqueue_struct *rx_wq;
    struct work_struct rx_worker;

    --
    1.6.6


    \
     
     \ /
      Last update: 2010-01-05 01:39    [W:4.920 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site