diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-01-03 11:19:35 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-01-18 10:19:46 -0800 |
| commit | 0ea5505e18a1cb8eebf3384f825840897894ceda (patch) | |
| tree | 0fde3e3bdcc7c30e895bfcc9d8123177d2e49d2d | |
| parent | 724ad42667b42b363bbef867d1c31850b599fecc (diff) | |
iwl: off by one bug
commit 8a9ac160e844c7ce8074f6aa531feefb4acdee7c upstream.
tid is used as an array offset.
agg = &priv->stations[sta_id].tid[tid].agg;
iwl4965_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
It should be limitted to MAX_TID_COUNT - 1;
struct iwl_tid_data tid[MAX_TID_COUNT];
regards,
dan carpenter
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/net/wireless/iwlwifi/iwl-4965.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c index f4e2e84e129..99331edd9d7 100644 --- a/drivers/net/wireless/iwlwifi/iwl-4965.c +++ b/drivers/net/wireless/iwlwifi/iwl-4965.c @@ -2087,7 +2087,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv, struct ieee80211_tx_info *info; struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0]; u32 status = le32_to_cpu(tx_resp->u.status); - int tid = MAX_TID_COUNT; + int tid = MAX_TID_COUNT - 1; int sta_id; int freed; u8 *qc = NULL; |