提交 f7738eda 编写于 作者: D Dan Carpenter 提交者: Greg Kroah-Hartman

Staging: rtl8192u: fix some memory corruption

When we received a command we incremented a stat counter depending on
the type of message.  The problem is there were 8 types of commands but
there were only 4 counters allocated so it corrupted memory past the
end of the rxcmdpkt[] array.

The fix is just to remove the counters because they aren't used.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
ACKed-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
上级 ed2cb4f3
...@@ -610,7 +610,6 @@ typedef struct Stats ...@@ -610,7 +610,6 @@ typedef struct Stats
// unsigned long rxnopointer; // unsigned long rxnopointer;
unsigned long rxok; unsigned long rxok;
unsigned long rxframgment; unsigned long rxframgment;
unsigned long rxcmdpkt[4]; //08/05/08 amy rx cmd element txfeedback/bcn report/cfg set/query
unsigned long rxurberr; unsigned long rxurberr;
unsigned long rxstaterr; unsigned long rxstaterr;
unsigned long received_rate_histogram[4][32]; //0: Total, 1:OK, 2:CRC, 3:ICV, 2007 07 03 cosa unsigned long received_rate_histogram[4][32]; //0: Total, 1:OK, 2:CRC, 3:ICV, 2007 07 03 cosa
......
...@@ -697,7 +697,6 @@ cmpk_message_handle_rx( ...@@ -697,7 +697,6 @@ cmpk_message_handle_rx(
struct ieee80211_rx_stats *pstats) struct ieee80211_rx_stats *pstats)
{ {
// u32 debug_level = DBG_LOUD; // u32 debug_level = DBG_LOUD;
struct r8192_priv *priv = ieee80211_priv(dev);
int total_length; int total_length;
u8 cmd_length, exe_cnt = 0; u8 cmd_length, exe_cnt = 0;
u8 element_id; u8 element_id;
...@@ -779,9 +778,6 @@ cmpk_message_handle_rx( ...@@ -779,9 +778,6 @@ cmpk_message_handle_rx(
// 2007/01/22 MH Add to display tx statistic. // 2007/01/22 MH Add to display tx statistic.
//cmpk_DisplayTxStatistic(pAdapter); //cmpk_DisplayTxStatistic(pAdapter);
/* 2007/03/09 MH Collect sidderent cmd element pkt num. */
priv->stats.rxcmdpkt[element_id]++;
total_length -= cmd_length; total_length -= cmd_length;
pcmd_buff += cmd_length; pcmd_buff += cmd_length;
} /* while (total_length > 0) */ } /* while (total_length > 0) */
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册