A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 11:11:45 -04:00
Code Issues Projects Releases Packages Wiki Activity

[PATCH] ipw2200: fix error log offset calculation

Browse source 
This fixes a slab corruption issue in the ipw2200 driver: it essentially
multiplied the error log number _twice_ by the size of the error element
entry (once explicitly in the code, and once implicitly as part of the
regular pointer arithmetic).

Cc: Henrik Brix Andersen <[email protected]>
Cc: Bernard Blackham <[email protected]>
Cc: Zilvinas Valinskas <[email protected]>
Cc: Pekka Enberg <[email protected]>
Signed-off-by: Zhu Yi <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
--
This commit is contained in:
Zhu Yi 2005-11-17 13:58:30 +08:00 • committed by Linus Torvalds
commit 3b26b1100e
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
drivers/net/wireless/ipw2200.c
View file

@ -1110,8 +1110,7 @@ static struct ipw_fw_error *ipw_alloc_error_log(struct ipw_priv *priv)
error->elem_len = elem_len;
error->log_len = log_len;
error->elem = (struct ipw_error_elem *)error->payload;
error->log = (struct ipw_event *)(error->elem +
(sizeof(*error->elem) * elem_len));
error->log = (struct ipw_event *)(error->elem + elem_len);
ipw_capture_event_log(priv, log_len, error->log);