Return-path: Received: from mga09.intel.com ([134.134.136.24]:46562 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751932Ab0BRSEn (ORCPT ); Thu, 18 Feb 2010 13:04:43 -0500 Subject: Re: [patch] iwlwifi: testing the wrong variable From: reinette chatre To: Dan Carpenter Cc: "Zhu, Yi" , Intel Linux Wireless , "John W. Linville" , "Guy, Wey-Yi W" , "Kolekar, Abhijeet" , Johannes Berg , "linux-wireless@vger.kernel.org" , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "kernel-janitors@vger.kernel.org" In-Reply-To: <20100218094529.GA1298@bicker> References: <20100218094529.GA1298@bicker> Content-Type: text/plain; charset="UTF-8" Date: Thu, 18 Feb 2010 10:04:42 -0800 Message-ID: <1266516282.2551.2604.camel@rchatre-DESK> Mime-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org List-ID: On Thu, 2010-02-18 at 01:45 -0800, Dan Carpenter wrote: > The first one fixes a smatch false positive and the second one fixes > a potential bug. > > drivers/net/wireless/iwlwifi/iwl-5000.c +786 iwl5000_txq_update_byte_cnt_tbl(37) error: buffer overflow > '(scd_bc_tbl+txq_id)->tfd_offset' 320 <= 512 > drivers/net/wireless/iwlwifi/iwl-5000.c +808 iwl5000_txq_inval_byte_cnt_tbl(19) error: buffer overflow > '(scd_bc_tbl+txq_id)->tfd_offset' 320 <= 512 > > Signed-off-by: Dan Carpenter > Cc: stable@kernel.org > --- This has already been fixed by patch below (taken from wireless-next-2.6). John and Greg, could you please pick this one up for 2.6.33 and stable instead? commit 8ce1ef4a914aef8b9b90a2a2c670494168a2cca9 Author: Wey-Yi Guy Date: Fri Jan 8 10:04:44 2010 -0800 iwlwifi: fix bug in tx byte count table When setting invalid byte count in txq byte count table, read pointer should be used instead of write pointer. Reported-by: Guo, Chaohong Signed-off-by: Wey-Yi Guy Signed-off-by: Zhu Yi Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville Reinette