* [patch] iwlwifi: range checking issue
@ 2010-03-28 11:55 Dan Carpenter
2010-03-29 2:01 ` Zhu Yi
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2010-03-28 11:55 UTC (permalink / raw)
To: Zhu Yi
Cc: Reinette Chatre, Intel Linux Wireless, John W. Linville,
Abhijeet Kolekar, Johannes Berg, Wey-Yi Guy, linux-wireless,
netdev, linux-kernel, kernel-janitors
IWL_RATE_COUNT is 13 and IWL_RATE_COUNT_LEGACY is 12.
IWL_RATE_COUNT_LEGACY is the right one here because iwl3945_rates
doesn't support 60M and also that's how "rates" is defined in
iwlcore_init_geos() from drivers/net/wireless/iwlwifi/iwl-core.c.
rates = kzalloc((sizeof(struct ieee80211_rate) * IWL_RATE_COUNT_LEGACY),
GFP_KERNEL);
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 54daa38..7d3806a 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1955,7 +1955,7 @@ static void iwl3945_init_hw_rates(struct iwl_priv *priv,
{
int i;
- for (i = 0; i < IWL_RATE_COUNT; i++) {
+ for (i = 0; i < IWL_RATE_COUNT_LEGACY; i++) {
rates[i].bitrate = iwl3945_rates[i].ieee * 5;
rates[i].hw_value = i; /* Rate scaling will work on indexes */
rates[i].hw_value_short = i;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [patch] iwlwifi: range checking issue
2010-03-28 11:55 [patch] iwlwifi: range checking issue Dan Carpenter
@ 2010-03-29 2:01 ` Zhu Yi
2010-03-29 16:13 ` reinette chatre
0 siblings, 1 reply; 3+ messages in thread
From: Zhu Yi @ 2010-03-29 2:01 UTC (permalink / raw)
To: Dan Carpenter
Cc: Chatre, Reinette, Intel Linux Wireless, John W. Linville,
Kolekar, Abhijeet, Berg, Johannes, Guy, Wey-Yi W, linux-wireless,
netdev, linux-kernel, kernel-janitors
On Sun, 2010-03-28 at 19:55 +0800, Dan Carpenter wrote:
> IWL_RATE_COUNT is 13 and IWL_RATE_COUNT_LEGACY is 12.
>
> IWL_RATE_COUNT_LEGACY is the right one here because iwl3945_rates
> doesn't support 60M and also that's how "rates" is defined in
> iwlcore_init_geos() from drivers/net/wireless/iwlwifi/iwl-core.c.
>
> rates = kzalloc((sizeof(struct ieee80211_rate) * IWL_RATE_COUNT_LEGACY),
> GFP_KERNEL);
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Zhu Yi <yi.zhu@intel.com>
Thanks,
-yi
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [patch] iwlwifi: range checking issue
2010-03-29 2:01 ` Zhu Yi
@ 2010-03-29 16:13 ` reinette chatre
0 siblings, 0 replies; 3+ messages in thread
From: reinette chatre @ 2010-03-29 16:13 UTC (permalink / raw)
To: Zhu, Yi
Cc: Dan Carpenter, Intel Linux Wireless, John W. Linville, Kolekar,
Abhijeet, Berg, Johannes, Guy, Wey-Yi W, linux-wireless, netdev,
linux-kernel, kernel-janitors
On Sun, 2010-03-28 at 19:01 -0700, Zhu, Yi wrote:
> On Sun, 2010-03-28 at 19:55 +0800, Dan Carpenter wrote:
> > IWL_RATE_COUNT is 13 and IWL_RATE_COUNT_LEGACY is 12.
> >
> > IWL_RATE_COUNT_LEGACY is the right one here because iwl3945_rates
> > doesn't support 60M and also that's how "rates" is defined in
> > iwlcore_init_geos() from drivers/net/wireless/iwlwifi/iwl-core.c.
> >
> > rates = kzalloc((sizeof(struct ieee80211_rate) * IWL_RATE_COUNT_LEGACY),
> > GFP_KERNEL);
> >
> > Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> Acked-by: Zhu Yi <yi.zhu@intel.com>
Great catch. Since this is a fix for a buffer overflow ... could you
please pass it on to stable also?
Thank you
Reinette
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-03-29 16:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-03-28 11:55 [patch] iwlwifi: range checking issue Dan Carpenter
2010-03-29 2:01 ` Zhu Yi
2010-03-29 16:13 ` reinette chatre
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).