commit 6c853da3f30c93eae847ecbcd9fdf10ba0da04c2
author Zhu Yi <yi.zhu@intel.com> Mon Dec 28 14:23:11 2009 +0800
committer John W. Linville <linville@tuxdriver.com> Mon Dec 28 16:20:07 2009 -0500
tree 916bb6d0a2664f1ba7818d12b84dc2b3351553f8
parent e8a4a6df7397eb3b43ad3139d3fe9b41df70d6b0

iwmc3200wifi: fix array out-of-boundary access

Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().

Cc: stable@kernel.org
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/iwmc3200wifi/iwm.h

diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 79ffa3b..8428111 100644
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -268,7 +268,7 @@
 
 	struct sk_buff_head rx_list;
 	struct list_head rx_tickets;
-	struct list_head rx_packets[IWM_RX_ID_HASH];
+	struct list_head rx_packets[IWM_RX_ID_HASH + 1];
 	struct workqueue_struct *rx_wq;
 	struct work_struct rx_worker;