Commit 6c853da3 authored by Zhu Yi's avatar Zhu Yi Committed by John W. Linville

iwmc3200wifi: fix array out-of-boundary access

Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().

Cc: stable@kernel.org
Signed-off-by: default avatarZhu Yi <yi.zhu@intel.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent e8a4a6df
...@@ -268,7 +268,7 @@ struct iwm_priv { ...@@ -268,7 +268,7 @@ struct iwm_priv {
struct sk_buff_head rx_list; struct sk_buff_head rx_list;
struct list_head rx_tickets; struct list_head rx_tickets;
struct list_head rx_packets[IWM_RX_ID_HASH]; struct list_head rx_packets[IWM_RX_ID_HASH + 1];
struct workqueue_struct *rx_wq; struct workqueue_struct *rx_wq;
struct work_struct rx_worker; struct work_struct rx_worker;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment