diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-04-17 23:37:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-04-18 16:58:16 -0700 |
| commit | f7738eda211091d8caf612b2bc1bac2fb52e48c6 (patch) | |
| tree | 74f8000ebd2a6e5df99c36db185a6003313d3a51 /drivers/staging/rtl8192u | |
| parent | ed2cb4f3b5ed96e4d10e054f981bbe58d0e3508e (diff) | |
Staging: rtl8192u: fix some memory corruption
When we received a command we incremented a stat counter depending on
the type of message. The problem is there were 8 types of commands but
there were only 4 counters allocated so it corrupted memory past the
end of the rxcmdpkt[] array.
The fix is just to remove the counters because they aren't used.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/rtl8192u')
| -rw-r--r-- | drivers/staging/rtl8192u/r8192U.h | 1 | ||||
| -rw-r--r-- | drivers/staging/rtl8192u/r819xU_cmdpkt.c | 4 |
2 files changed, 0 insertions, 5 deletions
diff --git a/drivers/staging/rtl8192u/r8192U.h b/drivers/staging/rtl8192u/r8192U.h index 9b81f26d40f..43d459d8188 100644 --- a/drivers/staging/rtl8192u/r8192U.h +++ b/drivers/staging/rtl8192u/r8192U.h @@ -610,7 +610,6 @@ typedef struct Stats // unsigned long rxnopointer; unsigned long rxok; unsigned long rxframgment; - unsigned long rxcmdpkt[4]; //08/05/08 amy rx cmd element txfeedback/bcn report/cfg set/query unsigned long rxurberr; unsigned long rxstaterr; unsigned long received_rate_histogram[4][32]; //0: Total, 1:OK, 2:CRC, 3:ICV, 2007 07 03 cosa diff --git a/drivers/staging/rtl8192u/r819xU_cmdpkt.c b/drivers/staging/rtl8192u/r819xU_cmdpkt.c index 0cb28c776c4..9348f429d59 100644 --- a/drivers/staging/rtl8192u/r819xU_cmdpkt.c +++ b/drivers/staging/rtl8192u/r819xU_cmdpkt.c @@ -697,7 +697,6 @@ cmpk_message_handle_rx( struct ieee80211_rx_stats *pstats) { // u32 debug_level = DBG_LOUD; - struct r8192_priv *priv = ieee80211_priv(dev); int total_length; u8 cmd_length, exe_cnt = 0; u8 element_id; @@ -779,9 +778,6 @@ cmpk_message_handle_rx( // 2007/01/22 MH Add to display tx statistic. //cmpk_DisplayTxStatistic(pAdapter); - /* 2007/03/09 MH Collect sidderent cmd element pkt num. */ - priv->stats.rxcmdpkt[element_id]++; - total_length -= cmd_length; pcmd_buff += cmd_length; } /* while (total_length > 0) */ |