releases/2.6.14.3/packet-writing-oops-fix.patch

   1 From stable-bounces@linux.kernel.org  Sun Nov 13 16:07:01 2005
   2 Date: Sun, 13 Nov 2005 16:06:36 -0800
   3 From: akpm@osdl.org
   4 To: torvalds@osdl.org
   5 Cc: petero2@telia.com, stable@kernel.org
   6 Subject: [PATCH] packet writing oops fix
   7
   8 From: Peter Osterlund <petero2@telia.com>
   9
  10 There is an old bug in the pkt_count_states() function that causes stack
  11 corruption.  When compiling with gcc 3.x or 2.x it is harmless, but gcc 4
  12 allocates local variables differently, which makes the bug visible.
  13
  14 Signed-off-by: Peter Osterlund <petero2@telia.com>
  15 Cc: <stable@kernel.org>
  16 Signed-off-by: Andrew Morton <akpm@osdl.org>
  17 Signed-off-by: Chris Wright <chrisw@osdl.org>
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  19 ---
  20  drivers/block/pktcdvd.c |    2 +-
  21  1 file changed, 1 insertion(+), 1 deletion(-)
  22
  23 --- linux-2.6.14.2.orig/drivers/block/pktcdvd.c
  24 +++ linux-2.6.14.2/drivers/block/pktcdvd.c
  25 @@ -1191,7 +1191,7 @@ static void pkt_count_states(struct pktc
  26         struct packet_data *pkt;
  27         int i;
  28
  29 -       for (i = 0; i <= PACKET_NUM_STATES; i++)
  30 +       for (i = 0; i < PACKET_NUM_STATES; i++)
  31                 states[i] = 0;
  32
  33         spin_lock(&pd->cdrw.active_list_lock);