* [PATCH] wireless: iwlwifi3945/4965 - fix incorrect counting of memory
@ 2008-01-26 16:09 Cyrill Gorcunov
2008-01-26 20:14 ` Tomas Winkler
0 siblings, 1 reply; 2+ messages in thread
From: Cyrill Gorcunov @ 2008-01-26 16:09 UTC (permalink / raw)
To: Thomas Tuttle; +Cc: LKML, Andrew Morton, Michael Wu, LWML
This patch does fix incorrect counting of memory allocated by kmalloc.
It seems that could lead to allocated memory overrun and corrupt
nearlaid memory area.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---
iwl3945-base.c | 2 +-
iwl4965-base.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
Index: linux-2.6.git/drivers/net/wireless/iwlwifi/iwl3945-base.c
===================================================================
--- linux-2.6.git.orig/drivers/net/wireless/iwlwifi/iwl3945-base.c 2008-01-24 18:26:11.000000000 +0300
+++ linux-2.6.git/drivers/net/wireless/iwlwifi/iwl3945-base.c 2008-01-26 18:45:03.000000000 +0300
@@ -6631,7 +6631,7 @@ static void iwl_bg_request_scan(struct w
* that based on the direct_mask added to each channel entry */
scan->tx_cmd.len = cpu_to_le16(
iwl_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
- IWL_MAX_SCAN_SIZE - sizeof(scan), 0));
+ IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
Index: linux-2.6.git/drivers/net/wireless/iwlwifi/iwl4965-base.c
===================================================================
--- linux-2.6.git.orig/drivers/net/wireless/iwlwifi/iwl4965-base.c 2008-01-26 18:45:38.000000000 +0300
+++ linux-2.6.git/drivers/net/wireless/iwlwifi/iwl4965-base.c 2008-01-26 18:46:06.000000000 +0300
@@ -6992,7 +6992,7 @@ static void iwl_bg_request_scan(struct w
* that based on the direct_mask added to each channel entry */
scan->tx_cmd.len = cpu_to_le16(
iwl_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
- IWL_MAX_SCAN_SIZE - sizeof(scan), 0));
+ IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] wireless: iwlwifi3945/4965 - fix incorrect counting of memory
2008-01-26 16:09 [PATCH] wireless: iwlwifi3945/4965 - fix incorrect counting of memory Cyrill Gorcunov
@ 2008-01-26 20:14 ` Tomas Winkler
0 siblings, 0 replies; 2+ messages in thread
From: Tomas Winkler @ 2008-01-26 20:14 UTC (permalink / raw)
To: Cyrill Gorcunov; +Cc: Thomas Tuttle, LKML, Andrew Morton, Michael Wu, LWML
On Jan 26, 2008 6:09 PM, Cyrill Gorcunov <gorcunov@gmail.com> wrote:
> This patch does fix incorrect counting of memory allocated by kmalloc.
> It seems that could lead to allocated memory overrun and corrupt
> nearlaid memory area.
>
> Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
>
> ---
>
> iwl3945-base.c | 2 +-
> iwl4965-base.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> Index: linux-2.6.git/drivers/net/wireless/iwlwifi/iwl3945-base.c
> ===================================================================
> --- linux-2.6.git.orig/drivers/net/wireless/iwlwifi/iwl3945-base.c 2008-01-24 18:26:11.000000000 +0300
> +++ linux-2.6.git/drivers/net/wireless/iwlwifi/iwl3945-base.c 2008-01-26 18:45:03.000000000 +0300
> @@ -6631,7 +6631,7 @@ static void iwl_bg_request_scan(struct w
> * that based on the direct_mask added to each channel entry */
> scan->tx_cmd.len = cpu_to_le16(
> iwl_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
> - IWL_MAX_SCAN_SIZE - sizeof(scan), 0));
> + IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
> scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
> scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
> scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
>
> Index: linux-2.6.git/drivers/net/wireless/iwlwifi/iwl4965-base.c
> ===================================================================
> --- linux-2.6.git.orig/drivers/net/wireless/iwlwifi/iwl4965-base.c 2008-01-26 18:45:38.000000000 +0300
> +++ linux-2.6.git/drivers/net/wireless/iwlwifi/iwl4965-base.c 2008-01-26 18:46:06.000000000 +0300
> @@ -6992,7 +6992,7 @@ static void iwl_bg_request_scan(struct w
> * that based on the direct_mask added to each channel entry */
> scan->tx_cmd.len = cpu_to_le16(
> iwl_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
> - IWL_MAX_SCAN_SIZE - sizeof(scan), 0));
> + IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
> scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
> scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
> scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
> -
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
Thanks.
ACK
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-01-26 20:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-01-26 16:09 [PATCH] wireless: iwlwifi3945/4965 - fix incorrect counting of memory Cyrill Gorcunov
2008-01-26 20:14 ` Tomas Winkler
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).