bcm43xx-d80211: Fix an off-by-one condition in handle_irq_noise

drivers/net/wireless/bcm43xx/bcm43xx_main.c +1 -1

@@ -1534,7 +1534,7 @@ static void handle_irq_noise(struct bcm4
  		goto generate_new;
 
  	/* Get the noise samples. */
-	assert(bcm->noisecalc.nr_samples <= 8);
+	assert(bcm->noisecalc.nr_samples < 8);
  	i = bcm->noisecalc.nr_samples;
  	noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);
  	noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1);

========================
-
To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 4 lines · you

An assert statement near the start of handle_irq_noise in the d80211 version of bcm43xx_main.c is there to protect against out of bound addressing using variable bcm->noisecalc.nr_samples. The arrays in question have a dimension of 8, thus the value must be < 8. This patch mirrors the one submitted earlier for the softmac version of bcm43xx.

Signed-off-by Larry.Finger <[email protected]>

drivers/net/wireless/bcm43xx/bcm43xx_main.c

Quoted 5 lines

========================================================

index 7ed18ca..37bb0dd 100644

drivers/net/wireless/bcm43xx/bcm43xx_main.c +0 -0

This is not a patch against bcm43xx-d80211.