aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorZhu Yi <yi.zhu@intel.com>2005-11-17 00:58:30 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2005-11-17 11:32:58 -0500
commit3b26b1100e26811e54770abaa221eae140ba840d (patch)
treeeb19e8e3145dfeb93ca5f1f9882302f5831fb35b /drivers/net
parentefb3442cf1c65747a858476e10f705612383eed1 (diff)
[PATCH] ipw2200: fix error log offset calculation
This fixes a slab corruption issue in the ipw2200 driver: it essentially multiplied the error log number _twice_ by the size of the error element entry (once explicitly in the code, and once implicitly as part of the regular pointer arithmetic). Cc: Henrik Brix Andersen <brix@gentoo.org> Cc: Bernard Blackham <bernard@blackham.com.au> Cc: Zilvinas Valinskas <zilvinas@gemtek.lt> Cc: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org> --
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/wireless/ipw2200.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index 374b682e4d6a..5e7c7e944c9d 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -1110,8 +1110,7 @@ static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv)
1110 error->elem_len = elem_len; 1110 error->elem_len = elem_len;
1111 error->log_len = log_len; 1111 error->log_len = log_len;
1112 error->elem = (struct ipw_error_elem *)error->payload; 1112 error->elem = (struct ipw_error_elem *)error->payload;
1113 error->log = (struct ipw_event *)(error->elem + 1113 error->log = (struct ipw_event *)(error->elem + elem_len);
1114 (sizeof(*error->elem) * elem_len));
1115 1114
1116 ipw_capture_event_log(priv, log_len, error->log); 1115 ipw_capture_event_log(priv, log_len, error->log);
1117 1116