From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] cfg80211: off by one in nl80211_trigger_scan() Date: Fri, 29 Jul 2011 11:52:18 +0300 Message-ID: <20110729085217.GG3752@shale.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: "John W. Linville" , "David S. Miller" , "open list:CFG80211 and NL80211" , "open list:NETWORKING [GENERAL]" , kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Johannes Berg Return-path: Content-Disposition: inline Sender: linux-wireless-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: netdev.vger.kernel.org The test is off by one so we'd read past the end of the wiphy->bands[] array on the next line. Signed-off-by: Dan Carpenter diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 28d2aa1..e83e7fe 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -3464,7 +3464,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) tmp) { enum ieee80211_band band = nla_type(attr); - if (band < 0 || band > IEEE80211_NUM_BANDS) { + if (band < 0 || band >= IEEE80211_NUM_BANDS) { err = -EINVAL; goto out_free; } -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html