* re: iwmc3200wifi: fix array out-of-boundary access
@ 2010-01-02 14:09 Dan Carpenter
2010-01-05 3:48 ` Zhu Yi
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2010-01-02 14:09 UTC (permalink / raw)
To: linux-wireless; +Cc: linville, yi.zhu
It don't think 6c853da3f30c93 is right. That's the patch
titled "iwmc3200wifi: fix array out-of-boundary access"
Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().
In 2.6.33-rc2 IWM_RX_ID_GET_HASH() doesn't go as high as IWM_RX_ID_HASH
and I don't see any array out-of-bounds.
#define IWM_RX_ID_GET_HASH(id) ((id) % IWM_RX_ID_HASH)
All the other code has the same assumptions.
Cscope tag: IWM_RX_ID_HASH
# line filename / context / line
1 175 drivers/net/wireless/iwmc3200wifi/iwm.h <<GLOBAL>>
#define IWM_RX_ID_HASH 0xff
2 271 drivers/net/wireless/iwmc3200wifi/iwm.h <<GLOBAL>>
struct list_head rx_packets[IWM_RX_ID_HASH];
3 292 drivers/net/wireless/iwmc3200wifi/debugfs.c <<iwm_debugfs_rx_ticket_read>>
for (i = 0; i < IWM_RX_ID_HASH; i++) {
4 176 drivers/net/wireless/iwmc3200wifi/iwm.h <<IWM_RX_ID_GET_HASH>>
#define IWM_RX_ID_GET_HASH(id) ((id) % IWM_RX_ID_HASH)
5 279 drivers/net/wireless/iwmc3200wifi/main.c <<iwm_priv_init>>
for (i = 0; i < IWM_RX_ID_HASH; i++)
6 396 drivers/net/wireless/iwmc3200wifi/rx.c <<iwm_rx_free>>
for (i = 0; i < IWM_RX_ID_HASH; i++) {
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread* re: iwmc3200wifi: fix array out-of-boundary access
2010-01-02 14:09 iwmc3200wifi: fix array out-of-boundary access Dan Carpenter
@ 2010-01-05 3:48 ` Zhu Yi
0 siblings, 0 replies; 2+ messages in thread
From: Zhu Yi @ 2010-01-05 3:48 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-wireless@vger.kernel.org, linville@tuxdriver.com
On Sat, 2010-01-02 at 22:09 +0800, Dan Carpenter wrote:
> It don't think 6c853da3f30c93 is right. That's the patch
> titled "iwmc3200wifi: fix array out-of-boundary access"
>
> Allocate priv->rx_packets[IWM_RX_ID_HASH + 1] because the max array
> index is IWM_RX_ID_HASH according to IWM_RX_ID_GET_HASH().
>
> In 2.6.33-rc2 IWM_RX_ID_GET_HASH() doesn't go as high as IWM_RX_ID_HASH
> and I don't see any array out-of-bounds.
>
> #define IWM_RX_ID_GET_HASH(id) ((id) % IWM_RX_ID_HASH)
Ah, you are right. I took '%' for '&'. John, would you revert it? Sorry
for the false alarm.
Thanks,
-yi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-01-05 3:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-01-02 14:09 iwmc3200wifi: fix array out-of-boundary access Dan Carpenter
2010-01-05 3:48 ` Zhu Yi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).