| commit | 8a9ac160e844c7ce8074f6aa531feefb4acdee7c | [log] [tgz] |
|---|---|---|
| author | Dan Carpenter <error27@gmail.com> | Sun Jan 03 11:19:35 2010 +0200 |
| committer | John W. Linville <linville@tuxdriver.com> | Mon Jan 04 16:09:48 2010 -0500 |
| tree | 5c31696085ac3bca8988f86d0d6cd22adabcc8e9 | |
| parent | 90852f7aed0f90d443efd7e0f9b82d8ac8186848 [diff] |
iwl: off by one bug
tid is used as an array offset.
agg = &priv->stations[sta_id].tid[tid].agg;
iwl4965_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
It should be limitted to MAX_TID_COUNT - 1;
struct iwl_tid_data tid[MAX_TID_COUNT];
regards,
dan carpenter
Signed-off-by: Dan Carpenter <error27@gmail.com>
CC: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>