• Reinette Chatre's avatar
    iwl3945: fix memory corruption · 1d79e53c
    Reinette Chatre authored
    Recent patch "iwlwifi: move 3945 clip groups to 3945 data" exposed a memory
    corruption problem. When initializing the clip groups the code was
    mistakenly using the iwlagn rate count, not the 3945 rate count. This
    resulted in more memory being written than was allocated.
    
    "iwlwifi: move 3945 clip groups to 3945 data" moved the location where the
    clip groups are stored and the impact is now severe in that the number of
    configured TX queues is modified. Previously the
    "temperature" field was overwritten, which did not seem to affect the
    operation.
    
    Fix this one instance where wrong rate count was used. I also noticed one
    more location where the iwlagn rate count was used to index an iwl3945
    array, fix this. I also modified one location that modified the iwlagn rate
    count to obtain the iwl3945 rate count ... just use the iwl3945 rate count
    directly.
    
    This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2165 and
    http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2168Signed-off-by: default avatarReinette Chatre <reinette.chatre@intel.com>
    1d79e53c
iwl-3945.c 83.3 KB