Messages in this thread | | | Subject | Re: [07/39] iwmc3200wifi: fix array out-of-boundary access | From | Zhu Yi <> | Date | Wed, 06 Jan 2010 10:52:56 +0800 |
| |
On Wed, 2010-01-06 at 04:02 +0800, Greg KH wrote: > 2.6.31-stable review patch. If anyone has any objections, please let us know.
Greg, please ignore this. It is false alarm and not required for stable. Sorry for the noise.
Thanks, -yi
> From: Zhu Yi <yi.zhu@intel.com> > > commit 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 upstream. > > Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array > index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH(). > > Signed-off-by: Zhu Yi <yi.zhu@intel.com> > Signed-off-by: John W. Linville <linville@tuxdriver.com> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> > > --- > drivers/net/wireless/iwmc3200wifi/iwm.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > --- a/drivers/net/wireless/iwmc3200wifi/iwm.h > +++ b/drivers/net/wireless/iwmc3200wifi/iwm.h > @@ -268,7 +268,7 @@ struct iwm_priv { > > struct sk_buff_head rx_list; > struct list_head rx_tickets; > - struct list_head rx_packets[IWM_RX_ID_HASH]; > + struct list_head rx_packets[IWM_RX_ID_HASH + 1]; > struct workqueue_struct *rx_wq; > struct work_struct rx_worker; > > >
| |