Re: [patch] iwlwifi: testing the wrong variable

[reinette chatre]

On Thu, 2010-02-18 at 01:45 -0800, Dan Carpenter wrote:
> The first one fixes a smatch false positive and the second one fixes
> a potential bug.
> 
> drivers/net/wireless/iwlwifi/iwl-5000.c +786 iwl5000_txq_update_byte_cnt_tbl(37) error: buffer overflow 
> '(scd_bc_tbl+txq_id)->tfd_offset' 320 <= 512
> drivers/net/wireless/iwlwifi/iwl-5000.c +808 iwl5000_txq_inval_byte_cnt_tbl(19) error: buffer overflow 
> '(scd_bc_tbl+txq_id)->tfd_offset' 320 <= 512
> 
> Signed-off-by: Dan Carpenter <error27@xxxxxxxxx>
> Cc: stable@xxxxxxxxxx
> ---

This has already been fixed by patch below (taken from
wireless-next-2.6). John and Greg, could you please pick this one up for
2.6.33 and stable instead?

commit 8ce1ef4a914aef8b9b90a2a2c670494168a2cca9
Author: Wey-Yi Guy <wey-yi.w.guy@xxxxxxxxx>
Date:   Fri Jan 8 10:04:44 2010 -0800

    iwlwifi: fix bug in tx byte count table
    
    When setting invalid byte count in txq byte count table, read
pointer
    should be used instead of write pointer.
    
    Reported-by: Guo, Chaohong <chaohong.guo@xxxxxxxxx>
    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@xxxxxxxxx>
    Signed-off-by: Zhu Yi <yi.zhu@xxxxxxxxx>
    Signed-off-by: Reinette Chatre <reinette.chatre@xxxxxxxxx>
    Signed-off-by: John W. Linville <linville@xxxxxxxxxxxxx>

Reinette


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/