projects / platform / kernel / linux-rpi.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a197e6d) | patch
iwlwifi: dbg: buffer overflow in non_collect_ts_start array
authorShahar S Matityahu <shahar.s.matityahu@intel.com>
Thu, 17 Jan 2019 07:57:27 +0000 (09:57 +0200)
committerLuca Coelho <luciano.coelho@intel.com>
Thu, 14 Feb 2019 09:29:51 +0000 (11:29 +0200)
commit21587a9b0a48bf8922e875b54edcc5a8a9a8b19f
tree8275c77d09b14998b0e92a28bde74e2a49d2cfb5tree | snapshot
parenta197e6d10ce26bdf4e7b8941321fb924b38ece02commit | diff
iwlwifi: dbg: buffer overflow in non_collect_ts_start array

The size of the buffer is IWL_FW_TRIGGER_ID_NUM - 1 which is equal to
IWL_FW_TRIGGER_ID_HOST_CHANNEL_SWITCH_COMPLETE so if the driver receives
this trigger, it will cause a buffer overflow.

Solve this by increasing the buffer size by 1.

Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Fixes: fe1b7d6c2888 ("iwlwifi: add support for triggering ini triggers")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
drivers/net/wireless/intel/iwlwifi/fw/runtime.h diff | blob | history
Domain: System / Kernel;