]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
iwl: off by one bug
authorDan Carpenter <error27@gmail.com>
Sun, 3 Jan 2010 09:19:35 +0000 (11:19 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 4 Jan 2010 21:09:48 +0000 (16:09 -0500)
tid is used as an array offset.
agg = &priv->stations[sta_id].tid[tid].agg;
iwl4965_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);

It should be limitted to MAX_TID_COUNT - 1;
        struct iwl_tid_data tid[MAX_TID_COUNT];

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>
CC: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/iwlwifi/iwl-4965.c

index 484c5fdf7c2a511143ed569ec11833f7d45d7424..761aab127e7caba1f46e940c53e2af88545cbac3 100644 (file)
@@ -1961,7 +1961,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
        struct ieee80211_tx_info *info;
        struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
        u32  status = le32_to_cpu(tx_resp->u.status);
-       int tid = MAX_TID_COUNT;
+       int tid = MAX_TID_COUNT - 1;
        int sta_id;
        int freed;
        u8 *qc = NULL;