[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20100105200259.864447568@mini.kroah.org>
Date: Tue, 05 Jan 2010 12:02:03 -0800
From: Greg KH <gregkh@...e.de>
To: linux-kernel@...r.kernel.org, stable@...nel.org,
akpm@...ux-foundation.org, torvalds@...ux-foundation.org,
stable-review@...nel.org
Cc: Zhu Yi <yi.zhu@...el.com>,
"John W. Linville" <linville@...driver.com>
Subject: [07/39] iwmc3200wifi: fix array out-of-boundary access
2.6.31-stable review patch. If anyone has any objections, please let us know.
------------------
From: Zhu Yi <yi.zhu@...el.com>
commit 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 upstream.
Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().
Signed-off-by: Zhu Yi <yi.zhu@...el.com>
Signed-off-by: John W. Linville <linville@...driver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>
---
drivers/net/wireless/iwmc3200wifi/iwm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -268,7 +268,7 @@ struct iwm_priv {
struct sk_buff_head rx_list;
struct list_head rx_tickets;
- struct list_head rx_packets[IWM_RX_ID_HASH];
+ struct list_head rx_packets[IWM_RX_ID_HASH + 1];
struct workqueue_struct *rx_wq;
struct work_struct rx_worker;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists