diff options
| author | Hante Meuleman <meuleman@broadcom.com> | 2014-01-06 12:40:38 +0100 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2014-01-06 15:47:59 -0500 |
| commit | d453399229cefff985391f079066ac5a84955537 (patch) | |
| tree | b6a3daa58c293b06e09b13b3840df95fd785755e /drivers/net/wireless/brcm80211/brcmfmac/bcdc.c | |
| parent | 75b39dd2408833ed4eaa16fe76473d1391ca49ee (diff) | |
| download | op-kernel-dev-d453399229cefff985391f079066ac5a84955537.zip op-kernel-dev-d453399229cefff985391f079066ac5a84955537.tar.gz | |
brcmfmac: Limit control message length from host to device.
An control request or set message length is restricted to
ETH frame length for the buffer from host to device. This
is limitation is imposed by the firmware.
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/brcm80211/brcmfmac/bcdc.c')
| -rw-r--r-- | drivers/net/wireless/brcm80211/brcmfmac/bcdc.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c index 12c27d1..c229210 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c @@ -41,9 +41,6 @@ struct brcmf_proto_bcdc_dcmd { __le32 status; /* status code returned from the device */ }; -/* Max valid buffer size that can be sent to the dongle */ -#define BCDC_MAX_MSG_SIZE (ETH_FRAME_LEN+ETH_FCS_LEN) - /* BCDC flag definitions */ #define BCDC_DCMD_ERROR 0x01 /* 1=cmd failed */ #define BCDC_DCMD_SET 0x02 /* 0=get, 1=set cmd */ @@ -133,9 +130,12 @@ brcmf_proto_bcdc_msg(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf, if (buf) memcpy(bcdc->buf, buf, len); + len += sizeof(*msg); + if (len > BRCMF_TX_IOCTL_MAX_MSG_SIZE) + len = BRCMF_TX_IOCTL_MAX_MSG_SIZE; + /* Send request */ - return brcmf_bus_txctl(drvr->bus_if, (unsigned char *)&bcdc->msg, - len + sizeof(struct brcmf_proto_bcdc_dcmd)); + return brcmf_bus_txctl(drvr->bus_if, (unsigned char *)&bcdc->msg, len); } static int brcmf_proto_bcdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len) |
