Commit 013cd397 authored by Jianjun Kong's avatar Jianjun Kong Committed by David S. Miller

mac80211: fix a buffer overrun in station debug code

net/mac80211/debugfs_sta.c
The trailing zero was written to state[4], it's out of bounds.
Signed-off-by: default avatarJianjun Kong <jianjun@zeuux.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b7b45f47
...@@ -199,7 +199,7 @@ static ssize_t sta_agg_status_write(struct file *file, ...@@ -199,7 +199,7 @@ static ssize_t sta_agg_status_write(struct file *file,
/* toggle Rx aggregation command */ /* toggle Rx aggregation command */
tid_num = tid_num - 100; tid_num = tid_num - 100;
if (tid_static_rx[tid_num] == 1) { if (tid_static_rx[tid_num] == 1) {
strcpy(state, "off "); strcpy(state, "off");
ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0, ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
WLAN_REASON_QSTA_REQUIRE_SETUP); WLAN_REASON_QSTA_REQUIRE_SETUP);
sta->ampdu_mlme.tid_state_rx[tid_num] |= sta->ampdu_mlme.tid_state_rx[tid_num] |=
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment