summaryrefslogtreecommitdiff
path: root/net/mac80211
diff options
context:
space:
mode:
authorChristian Lamparter <chunkeey@googlemail.com>2012-07-07 15:07:13 +0200
committerJohn W. Linville <linville@tuxdriver.com>2012-07-10 11:42:52 -0400
commit353d09c6ceedc1cb0c54fe5002c0ca80b6ee6e4f (patch)
treed985401bd1aafb20022583abc27dd2308fc832f8 /net/mac80211
parentf8bf65bf3688835f95f7c74f5c844a64b2743a42 (diff)
mac80211: fix read outside array bounds
ieee802_1d_to_ac is defined as a const int[8], but the tid parameter has a range from 0 to 15. Cc: stable@vger.kernel.org Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211')
-rw-r--r--net/mac80211/tx.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e453212fa17f..85cf32d2f7b5 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2733,7 +2733,7 @@ EXPORT_SYMBOL(ieee80211_get_buffered_bc);
void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb, int tid)
{
- int ac = ieee802_1d_to_ac[tid];
+ int ac = ieee802_1d_to_ac[tid & 7];
skb_set_mac_header(skb, 0);
skb_set_network_header(skb, 0);