diff options
| author | Martin Kaiser <[email protected]> | 2021-09-18 15:40:24 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2021-09-20 13:40:40 +0200 |
| commit | 037116c8f047a1912b33b7e9411e755864a7b7c5 (patch) | |
| tree | 6c0501a9d6f1c3e0fd0abc04386fc6dd91ae01f4 /tools/perf/scripts/python | |
| parent | c2e478e74cb684627265008f8041cf7c6acd6519 (diff) | |
staging: r8188eu: do not write past the end of an array
Commit f7b687d6b67e ("staging: r8188eu: remove NumTotalRFPath from struct
hal_data_8188e") removed a for loop around a block of code that is executed
only once when i == 0. However, without the for loop, i will never be set
to 0 before the code block is executed. i remains at 2, which is the final
value after the previous loop. This results in a write past the end of the
powerlevel and MCSBase arrays.
[ 28.480809] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: rtl8188e_PHY_RF6052SetOFDMTxPower+0x124/0x128 [r8188eu]
[ 28.493752] ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: rtl8188e_PHY_RF6052SetOFDMTxPower+0x124/0x128 [r8188eu] ]---
Fix this by replacing i with 0 in the code block that used to be the body of
the loop. While at it, remove the powerlevel array that was just holding a
temporary value.
Tested with Edimax EW-7811Un V2 on an ARM32 embedded system.
Fixes: f7b687d6b67e ("staging: r8188eu: remove NumTotalRFPath from struct hal_data_8188e")
Acked-by: Michael Straube <[email protected]>
Signed-off-by: Martin Kaiser <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions