diff options
author | Rajkumar Manoharan <rmanohar@qca.qualcomm.com> | 2012-11-27 03:21:32 -0500 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2012-11-30 13:38:14 -0500 |
commit | d6144d85f830848ab31eb5d073d9bb4742b64e03 (patch) | |
tree | 9bc81b43a00ce23655092ae79f8aa4d0f4437d0f /drivers/net/wireless/ath/ath9k | |
parent | 0362063b7be97f6f8e2c644b970f5726489aacdf (diff) |
ath9k: Fix buffer overflow error
The commit "ath9k: stomp audio profiles on weak signal
strength" failed to take care of new stomp type while
programming concurrent tx priority. That leads to array
index out of bounds access.
drivers/net/wireless/ath/ath9k/btcoex.c:414
ath9k_hw_btcoex_set_concur_txprio()
error: buffer overflow 'stomp_txprio' 4 <= 4
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath9k')
-rw-r--r-- | drivers/net/wireless/ath/ath9k/mci.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c index 706378ea3ba2..5c02702f21e7 100644 --- a/drivers/net/wireless/ath/ath9k/mci.c +++ b/drivers/net/wireless/ath/ath9k/mci.c | |||
@@ -257,8 +257,9 @@ static void ath_mci_set_concur_txprio(struct ath_softc *sc) | |||
257 | { | 257 | { |
258 | struct ath_btcoex *btcoex = &sc->btcoex; | 258 | struct ath_btcoex *btcoex = &sc->btcoex; |
259 | struct ath_mci_profile *mci = &btcoex->mci; | 259 | struct ath_mci_profile *mci = &btcoex->mci; |
260 | u8 stomp_txprio[] = { 0, 0, 0, 0 }; /* all, low, none, low_ftp */ | 260 | u8 stomp_txprio[ATH_BTCOEX_STOMP_MAX]; |
261 | 261 | ||
262 | memset(stomp_txprio, 0, sizeof(stomp_txprio)); | ||
262 | if (mci->num_mgmt) { | 263 | if (mci->num_mgmt) { |
263 | stomp_txprio[ATH_BTCOEX_STOMP_ALL] = ATH_MCI_INQUIRY_PRIO; | 264 | stomp_txprio[ATH_BTCOEX_STOMP_ALL] = ATH_MCI_INQUIRY_PRIO; |
264 | if (!mci->num_pan && !mci->num_other_acl) | 265 | if (!mci->num_pan && !mci->num_other_acl) |