summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAdam Baker <linux@baker-net.org.uk>2008-02-03 15:46:24 +0100
committerJohn W. Linville <linville@tuxdriver.com>2008-02-29 15:19:27 -0500
commitd7bafff3f94efd850f8744d683e63812ff8d55c5 (patch)
treeba2276597e2a533af54eff7db1042be2f8f7cbe2
parent181d6902b6bad978d157e69479c95cc0ff213a76 (diff)
downloadop-kernel-dev-d7bafff3f94efd850f8744d683e63812ff8d55c5.zip
op-kernel-dev-d7bafff3f94efd850f8744d683e63812ff8d55c5.tar.gz
rt2x00: don't write past the end when writing short descriptors on rt61
The space allocated in the skb for a descriptor is only 24 bytes when setting up beacons in rt61 so make sure we don't write to the descriptor words beyond that and corrupt the beacon packet. Signed-off-by: Adam Baker <linux@baker-net.org.uk> Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--drivers/net/wireless/rt2x00/rt61pci.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 547fa33..5e08541 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1531,9 +1531,11 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
rt2x00_desc_write(txd, 5, word);
- rt2x00_desc_read(txd, 11, &word);
- rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skbdesc->data_len);
- rt2x00_desc_write(txd, 11, word);
+ if (skbdesc->desc_len > TXINFO_SIZE) {
+ rt2x00_desc_read(txd, 11, &word);
+ rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skbdesc->data_len);
+ rt2x00_desc_write(txd, 11, word);
+ }
rt2x00_desc_read(txd, 0, &word);
rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
OpenPOWER on IntegriCloud