Files
linux/drivers/net/wireless/ath/ath9k
Dan Carpenter 01fe812522 ath9k_htc: memory corruption calling set_bit()
commit 191f1aeeb9 upstream.

In d8a2c51cdc ('ath9k_htc: Use atomic operations for op_flags') we
changed things like this:

-	if (priv->op_flags & OP_TSF_RESET) {
+	if (test_bit(OP_TSF_RESET, &priv->op_flags)) {

The problem is that test_bit() takes a bit number and not a mask.  It
means that when we do:

	set_bit(OP_TSF_RESET, &priv->op_flags);

Then it sets the (1 << 6) bit instead of the 6 bit so we are setting a
bit which is past the end of the unsigned long.

Fixes: d8a2c51cdc ('ath9k_htc: Use atomic operations for op_flags')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-08-03 09:28:58 -07:00
..
2015-01-15 14:24:57 +02:00
2015-03-20 08:28:11 +02:00
2015-03-20 08:28:11 +02:00
2015-01-15 14:25:03 +02:00
2015-03-20 08:27:17 +02:00
2015-03-03 14:55:24 +02:00
2015-01-15 14:25:03 +02:00
2015-03-13 15:19:36 +02:00
2015-03-30 11:31:32 +03:00
2014-04-30 11:42:35 -04:00
2015-03-03 15:36:01 +02:00
2015-04-07 20:15:01 +03:00
2015-02-26 15:20:38 +02:00
2014-02-12 15:36:03 -05:00
2015-03-20 08:27:17 +02:00
2015-04-07 20:15:01 +03:00
2015-04-07 20:15:01 +03:00
2015-01-15 14:25:03 +02:00
2015-03-20 08:27:17 +02:00
2015-03-03 14:55:24 +02:00
2015-02-03 15:31:04 +02:00
2015-01-15 14:25:03 +02:00
2015-03-03 14:55:27 +02:00
2015-02-26 14:58:43 +02:00
2015-04-07 20:15:01 +03:00
2014-10-27 14:16:14 -04:00