lkml.org 
[lkml]   [2010]   [Jan]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [07/39] iwmc3200wifi: fix array out-of-boundary access
From
Date
On Wed, 2010-01-06 at 04:02 +0800, Greg KH wrote:
> 2.6.31-stable review patch. If anyone has any objections, please let us know.

Greg, please ignore this. It is false alarm and not required for stable.
Sorry for the noise.

Thanks,
-yi

> From: Zhu Yi <yi.zhu@intel.com>
>
> commit 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 upstream.
>
> Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
> index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().
>
> Signed-off-by: Zhu Yi <yi.zhu@intel.com>
> Signed-off-by: John W. Linville <linville@tuxdriver.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>
> ---
> drivers/net/wireless/iwmc3200wifi/iwm.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/drivers/net/wireless/iwmc3200wifi/iwm.h
> +++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
> @@ -268,7 +268,7 @@ struct iwm_priv {
>
> struct sk_buff_head rx_list;
> struct list_head rx_tickets;
> - struct list_head rx_packets[IWM_RX_ID_HASH];
> + struct list_head rx_packets[IWM_RX_ID_HASH + 1];
> struct workqueue_struct *rx_wq;
> struct work_struct rx_worker;
>
>
>




\
 
 \ /
  Last update: 2010-01-06 03:55    [W:0.295 / U:0.656 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site