forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

iwmc3200wifi: fix array out-of-boundary access

Browse source 
Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().

Cc: stable@kernel.org
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Zhu Yi 2009-12-28 14:23:11 +08:00 • committed by John W. Linville
commit 6c853da3f3
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/net/wireless/iwmc3200wifi/iwm.h
View file

@ -268,7 +268,7 @@ struct iwm_priv {
struct sk_buff_head rx_list; struct sk_buff_head rx_list;
struct list_head rx_tickets; struct list_head rx_tickets;
struct list_head rx_packets[IWM_RX_ID_HASH]; struct list_head rx_packets[IWM_RX_ID_HASH + 1];
struct workqueue_struct *rx_wq; struct workqueue_struct *rx_wq;
struct work_struct rx_worker; struct work_struct rx_worker;