This patch fixes a panic which can be triggered by an
out-of-bound array access.
Signed-off-by: Christian Lamparter <chunkeey@xxxxxxxxxxxxxx>
---
static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
---
--- a/net/mac80211/rc80211_minstrel_ht.c.orig 2010-03-21 03:30:04.000000000 +0100
+++ b/net/mac80211/rc80211_minstrel_ht.c 2010-03-21 03:30:33.000000000 +0100
@@ -318,9 +318,9 @@ minstrel_next_sample_idx(struct minstrel
if (!mg->supported)
continue;
- if (++mg->index > MCS_GROUP_RATES) {
+ if (++mg->index >= MCS_GROUP_RATES) {
mg->index = 0;
- if (++mg->column > ARRAY_SIZE(sample_table))
+ if (++mg->column >= ARRAY_SIZE(sample_table))
mg->column = 0;
}
break;
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
