From: Dan Carpenter <error27@gmail.com>
Date: Sun, 3 Jan 2010 09:19:35 +0000 (+0200)
Subject: iwl: off by one bug
X-Git-Tag: v2.6.33-rc5~71^2~13^2~17
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8a9ac160e844c7ce8074f6aa531feefb4acdee7c;p=pandora-kernel.git

iwl: off by one bug

tid is used as an array offset.
	agg = &priv->stations[sta_id].tid[tid].agg;
	iwl4965_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);

It should be limitted to MAX_TID_COUNT - 1;
        struct iwl_tid_data tid[MAX_TID_COUNT];

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>
CC: stable@kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

Reading git-diff-tree failed