diff options
| author |   Zhu Yi <yi.zhu@intel.com> | 2005-11-17 13:58:30 +0800 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@g5.osdl.org> | 2005-11-17 08:32:58 -0800 |
| commit | 3b26b1100e26811e54770abaa221eae140ba840d (patch) | |
| tree | eb19e8e3145dfeb93ca5f1f9882302f5831fb35b | |
| parent | [PATCH] ipw2200: disallow direct scanning when device is down (diff) | |
| download | linux-dev-3b26b1100e26811e54770abaa221eae140ba840d.tar.xz linux-dev-3b26b1100e26811e54770abaa221eae140ba840d.zip | |
[PATCH] ipw2200: fix error log offset calculation
This fixes a slab corruption issue in the ipw2200 driver: it essentially
multiplied the error log number _twice_ by the size of the error element
entry (once explicitly in the code, and once implicitly as part of the
regular pointer arithmetic).
Cc: Henrik Brix Andersen <brix@gentoo.org>
Cc: Bernard Blackham <bernard@blackham.com.au>
Cc: Zilvinas Valinskas <zilvinas@gemtek.lt>
Cc: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
--
| -rw-r--r-- | drivers/net/wireless/ipw2200.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c index 374b682e4d6a..5e7c7e944c9d 100644 --- a/drivers/net/wireless/ipw2200.c +++ b/drivers/net/wireless/ipw2200.c @@ -1110,8 +1110,7 @@ static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv) error->elem_len = elem_len; error->log_len = log_len; error->elem = (struct ipw_error_elem *)error->payload; - error->log = (struct ipw_event *)(error->elem + - (sizeof(*error->elem) * elem_len)); + error->log = (struct ipw_event *)(error->elem + elem_len); ipw_capture_event_log(priv, log_len, error->log); |