From: Cyrill Gorcunov <gorcunov@gmail.com>
To: Thomas Tuttle <linux-kernel@ttuttle.net>
Cc: LKML <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Michael Wu <flamingice@sourmilk.net>,
LWML <linux-wireless@vger.kernel.org>
Subject: [PATCH] wireless: iwlwifi3945/4965 - fix incorrect counting of memory
Date: Sat, 26 Jan 2008 19:09:36 +0300 [thread overview]
Message-ID: <20080126160936.GB6738@cvg> (raw)
This patch does fix incorrect counting of memory allocated by kmalloc.
It seems that could lead to allocated memory overrun and corrupt
nearlaid memory area.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---
iwl3945-base.c | 2 +-
iwl4965-base.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
Index: linux-2.6.git/drivers/net/wireless/iwlwifi/iwl3945-base.c
===================================================================
--- linux-2.6.git.orig/drivers/net/wireless/iwlwifi/iwl3945-base.c 2008-01-24 18:26:11.000000000 +0300
+++ linux-2.6.git/drivers/net/wireless/iwlwifi/iwl3945-base.c 2008-01-26 18:45:03.000000000 +0300
@@ -6631,7 +6631,7 @@ static void iwl_bg_request_scan(struct w
* that based on the direct_mask added to each channel entry */
scan->tx_cmd.len = cpu_to_le16(
iwl_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
- IWL_MAX_SCAN_SIZE - sizeof(scan), 0));
+ IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
Index: linux-2.6.git/drivers/net/wireless/iwlwifi/iwl4965-base.c
===================================================================
--- linux-2.6.git.orig/drivers/net/wireless/iwlwifi/iwl4965-base.c 2008-01-26 18:45:38.000000000 +0300
+++ linux-2.6.git/drivers/net/wireless/iwlwifi/iwl4965-base.c 2008-01-26 18:46:06.000000000 +0300
@@ -6992,7 +6992,7 @@ static void iwl_bg_request_scan(struct w
* that based on the direct_mask added to each channel entry */
scan->tx_cmd.len = cpu_to_le16(
iwl_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
- IWL_MAX_SCAN_SIZE - sizeof(scan), 0));
+ IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
next reply other threads:[~2008-01-26 16:09 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-01-26 16:09 Cyrill Gorcunov [this message]
2008-01-26 20:14 ` [PATCH] wireless: iwlwifi3945/4965 - fix incorrect counting of memory Tomas Winkler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080126160936.GB6738@cvg \
--to=gorcunov@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=flamingice@sourmilk.net \
--cc=linux-kernel@ttuttle.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox