This is a note to let you know that I've just added the patch titled
mac80211: fix read outside array bounds
to the 3.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
mac80211-fix-read-outside-array-bounds.patch
and it can be found in the queue-3.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 353d09c6ceedc1cb0c54fe5002c0ca80b6ee6e4f Mon Sep 17 00:00:00 2001
From: Christian Lamparter <[email protected]>
Date: Sat, 7 Jul 2012 15:07:13 +0200
Subject: mac80211: fix read outside array bounds
From: Christian Lamparter <[email protected]>
commit 353d09c6ceedc1cb0c54fe5002c0ca80b6ee6e4f upstream.
ieee802_1d_to_ac is defined as a const int[8],
but the tid parameter has a range from 0 to 15.
Signed-off-by: Christian Lamparter <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/mac80211/tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2733,7 +2733,7 @@ EXPORT_SYMBOL(ieee80211_get_buffered_bc)
void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb, int tid)
{
- int ac = ieee802_1d_to_ac[tid];
+ int ac = ieee802_1d_to_ac[tid & 7];
skb_set_mac_header(skb, 0);
skb_set_network_header(skb, 0);
Patches currently in stable-queue which might be from [email protected]
are
queue-3.5/mac80211-fix-read-outside-array-bounds.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
