From: Dan Carpenter Date: Fri, 15 Oct 2010 03:42:00 +0000 (+0200) Subject: Staging: ft1000-usb: fix array overflow X-Git-Tag: v2.6.37-rc1~60^2~3^2~93 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fcbf77bf872c28ac3f18261a44af91383f0a2f3d;p=pandora-kernel.git Staging: ft1000-usb: fix array overflow The code here is supposed checking if we exited the loop without hitting a break. The problem is that in the error handling "i" is out of bounds and it corrupts memory when we do an info->app_info[i].nRxMsgMiss++. >From the comments, it looks like someone noticed this corruption and updated the code, but didn't totally fix the problem. The correct fix is just to remove nRxMsgMiss++ from the error path. I believe this bug can be triggered remotely. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed