aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorZhu Yi <yi.zhu@intel.com>2009-12-28 01:23:11 -0500
committerJohn W. Linville <linville@tuxdriver.com>2009-12-28 16:20:07 -0500
commit6c853da3f30c93eae847ecbcd9fdf10ba0da04c2 (patch)
tree916bb6d0a2664f1ba7818d12b84dc2b3351553f8 /drivers/net
parente8a4a6df7397eb3b43ad3139d3fe9b41df70d6b0 (diff)
iwmc3200wifi: fix array out-of-boundary access
Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH(). Cc: stable@kernel.org Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/wireless/iwmc3200wifi/iwm.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 79ffa3b98d73..842811142bef 100644
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -268,7 +268,7 @@ struct iwm_priv {
268 268
269 struct sk_buff_head rx_list; 269 struct sk_buff_head rx_list;
270 struct list_head rx_tickets; 270 struct list_head rx_tickets;
271 struct list_head rx_packets[IWM_RX_ID_HASH]; 271 struct list_head rx_packets[IWM_RX_ID_HASH + 1];
272 struct workqueue_struct *rx_wq; 272 struct workqueue_struct *rx_wq;
273 struct work_struct rx_worker; 273 struct work_struct rx_worker;
274 274