lkml.org 
[lkml]   [2008]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patches in this message
/
Date
From
Subject[PATCH] wireless: iwlwifi3945/4965 - fix incorrect counting of memory
This patch does fix incorrect counting of memory allocated by kmalloc.
It seems that could lead to allocated memory overrun and corrupt
nearlaid memory area.

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>

---

iwl3945-base.c | 2 +-
iwl4965-base.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

Index: linux-2.6.git/drivers/net/wireless/iwlwifi/iwl3945-base.c
===================================================================
--- linux-2.6.git.orig/drivers/net/wireless/iwlwifi/iwl3945-base.c 2008-01-24 18:26:11.000000000 +0300
+++ linux-2.6.git/drivers/net/wireless/iwlwifi/iwl3945-base.c 2008-01-26 18:45:03.000000000 +0300
@@ -6631,7 +6631,7 @@ static void iwl_bg_request_scan(struct w
* that based on the direct_mask added to each channel entry */
scan->tx_cmd.len = cpu_to_le16(
iwl_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
- IWL_MAX_SCAN_SIZE - sizeof(scan), 0));
+ IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
Index: linux-2.6.git/drivers/net/wireless/iwlwifi/iwl4965-base.c
===================================================================
--- linux-2.6.git.orig/drivers/net/wireless/iwlwifi/iwl4965-base.c 2008-01-26 18:45:38.000000000 +0300
+++ linux-2.6.git/drivers/net/wireless/iwlwifi/iwl4965-base.c 2008-01-26 18:46:06.000000000 +0300
@@ -6992,7 +6992,7 @@ static void iwl_bg_request_scan(struct w
* that based on the direct_mask added to each channel entry */
scan->tx_cmd.len = cpu_to_le16(
iwl_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
- IWL_MAX_SCAN_SIZE - sizeof(scan), 0));
+ IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;

\
 
 \ /
  Last update: 2008-01-26 17:15    [W:0.031 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site