git://ftp.safe.ca / safe / jmp / linux-2.6 / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 90852f7) | patch
iwl: off by one bug
authorDan Carpenter <error27@gmail.com>
Sun, 3 Jan 2010 09:19:35 +0000 (11:19 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 4 Jan 2010 21:09:48 +0000 (16:09 -0500)
commit8a9ac160e844c7ce8074f6aa531feefb4acdee7c
tree5c31696085ac3bca8988f86d0d6cd22adabcc8e9tree | snapshot
parent90852f7aed0f90d443efd7e0f9b82d8ac8186848commit | diff
iwl: off by one bug

tid is used as an array offset.
agg = &priv->stations[sta_id].tid[tid].agg;
iwl4965_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);

It should be limitted to MAX_TID_COUNT - 1;
        struct iwl_tid_data tid[MAX_TID_COUNT];

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>
CC: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/iwlwifi/iwl-4965.c diff | blob | history
Full containers within linux kernel