Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753958AbYKHCg0 (ORCPT ); Fri, 7 Nov 2008 21:36:26 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752576AbYKHCfy (ORCPT ); Fri, 7 Nov 2008 21:35:54 -0500 Received: from smtp.zeuux.org ([210.51.160.52]:60823 "EHLO z.billxu.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751780AbYKHCfw (ORCPT ); Fri, 7 Nov 2008 21:35:52 -0500 Date: Sat, 8 Nov 2008 10:35:58 +0800 From: Jianjun Kong To: linville@tuxdriver.com Cc: Linux-Kernel-Mailing-List , netdev Subject: [PATCH] nets: fix a buffer overrun Message-ID: <20081108023558.GB6384@ubuntu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1037 Lines: 29 net/mac80211/debugfs_sta.c The trailing zero was written to state[4], it's out of bounds. Signed-off-by: Jianjun Kong --- net/mac80211/debugfs_sta.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c index 189d0ba..b85c4f2 100644 --- a/net/mac80211/debugfs_sta.c +++ b/net/mac80211/debugfs_sta.c @@ -199,7 +199,7 @@ static ssize_t sta_agg_status_write(struct file *file, /* toggle Rx aggregation command */ tid_num = tid_num - 100; if (tid_static_rx[tid_num] == 1) { - strcpy(state, "off "); + strcpy(state, "off"); ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0, WLAN_REASON_QSTA_REQUIRE_SETUP); sta->ampdu_mlme.tid_state_rx[tid_num] |= -- 1.5.6.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/