Commit 6c853da3 authored Dec 28, 2009 by Zhu Yi Committed by John W. Linville Dec 28, 2009

iwmc3200wifi: fix array out-of-boundary access



Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().

Cc: stable@kernel.org
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent e8a4a6df

drivers/net/wireless/iwmc3200wifi/iwm.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -268,7 +268,7 @@ struct iwm_priv {

		struct sk_buff_head rx_list;
		struct list_head rx_tickets;
		struct list_head rx_packets[IWM_RX_ID_HASH];
		struct list_head rx_packets[IWM_RX_ID_HASH + 1];
		struct workqueue_struct *rx_wq;
		struct work_struct rx_worker;