projects / firefly-linux-kernel-4.4.55.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 724ad42) | patch
iwl: off by one bug
authorDan Carpenter <error27@gmail.com>
Sun, 3 Jan 2010 09:19:35 +0000 (11:19 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 18 Jan 2010 18:19:46 +0000 (10:19 -0800)
commit0ea5505e18a1cb8eebf3384f825840897894ceda
tree0fde3e3bdcc7c30e895bfcc9d8123177d2e49d2dtree | snapshot
parent724ad42667b42b363bbef867d1c31850b599fecccommit | diff
iwl: off by one bug

commit 8a9ac160e844c7ce8074f6aa531feefb4acdee7c upstream.

tid is used as an array offset.
agg = &priv->stations[sta_id].tid[tid].agg;
iwl4965_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);

It should be limitted to MAX_TID_COUNT - 1;
        struct iwl_tid_data tid[MAX_TID_COUNT];

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/net/wireless/iwlwifi/iwl-4965.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.