From: Cyrill Gorcunov Date: Sat, 26 Jan 2008 16:09:36 +0000 (+0300) Subject: wireless: iwlwifi3945/4965 - fix incorrect counting of memory X-Git-Tag: v2.6.25-rc1~1089^2~152 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=18904f5839336d7d047fdb20a9e7db87f2942ec9;p=linux-2.6-omap-h63xx.git wireless: iwlwifi3945/4965 - fix incorrect counting of memory This patch does fix incorrect counting of memory allocated by kmalloc. It seems that could lead to allocated memory overrun and corrupt nearlaid memory area. Signed-off-by: Cyrill Gorcunov Acked-by: Tomas Winkler Signed-off-by: John W. Linville Signed-off-by: David S. Miller --- diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c index 5d8965e0b90..33239f19798 100644 --- a/drivers/net/wireless/iwlwifi/iwl3945-base.c +++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c @@ -6628,7 +6628,7 @@ static void iwl3945_bg_request_scan(struct work_struct *data) * that based on the direct_mask added to each channel entry */ scan->tx_cmd.len = cpu_to_le16( iwl3945_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data, - IWL_MAX_SCAN_SIZE - sizeof(scan), 0)); + IWL_MAX_SCAN_SIZE - sizeof(*scan), 0)); scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK; scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id; scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE; diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c index abdce17f60e..bf3a60c037a 100644 --- a/drivers/net/wireless/iwlwifi/iwl4965-base.c +++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c @@ -7046,7 +7046,7 @@ static void iwl4965_bg_request_scan(struct work_struct *data) * that based on the direct_mask added to each channel entry */ scan->tx_cmd.len = cpu_to_le16( iwl4965_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data, - IWL_MAX_SCAN_SIZE - sizeof(scan), 0)); + IWL_MAX_SCAN_SIZE - sizeof(*scan), 0)); scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK; scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id; scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;