diff options
| author | Zhu Yi <yi.zhu@intel.com> | 2009-12-28 14:23:11 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-01-06 15:04:03 -0800 |
| commit | 38cf2a039fec0233c1ab81b09125e56311574016 (patch) | |
| tree | 136d196ec4c2339665e032a576e54c11d211b382 /drivers/net/wireless | |
| parent | 08a93783c334ec4b42532b0dad62dc480a6ec823 (diff) | |
| download | lwn-38cf2a039fec0233c1ab81b09125e56311574016.tar.gz lwn-38cf2a039fec0233c1ab81b09125e56311574016.zip | |
iwmc3200wifi: fix array out-of-boundary access
commit 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 upstream.
Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/iwmc3200wifi/iwm.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h index 1b02a4e2a1ac..93c898990cce 100644 --- a/drivers/net/wireless/iwmc3200wifi/iwm.h +++ b/drivers/net/wireless/iwmc3200wifi/iwm.h @@ -258,7 +258,7 @@ struct iwm_priv { struct sk_buff_head rx_list; struct list_head rx_tickets; - struct list_head rx_packets[IWM_RX_ID_HASH]; + struct list_head rx_packets[IWM_RX_ID_HASH + 1]; struct workqueue_struct *rx_wq; struct work_struct rx_worker; |