diff options
| author | Seth Forshee <seth.forshee@canonical.com> | 2011-02-14 08:52:25 -0600 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-02-14 15:50:17 -0500 |
| commit | d76dfc612b40b6a9de0a3fe57fe1fa3db7a1ae3b (patch) | |
| tree | 169aca14bd1a3514452aeac5170214280937a6eb /drivers/net/wireless/rt2x00/rt61pci.c | |
| parent | a3dc5e881a8a5199bf371fdd4530cfa18280ca83 (diff) | |
| download | op-kernel-dev-d76dfc612b40b6a9de0a3fe57fe1fa3db7a1ae3b.zip op-kernel-dev-d76dfc612b40b6a9de0a3fe57fe1fa3db7a1ae3b.tar.gz | |
rt2x00: Check for errors from skb_pad() calls
Commit 739fd94 ("rt2x00: Pad beacon to multiple of 32 bits")
added calls to skb_pad() without checking the return value,
which could cause problems if any of those calls does happen
to fail. Add checks to prevent this from happening.
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/rt2x00/rt61pci.c')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt61pci.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c index dd2164d..927a4a3 100644 --- a/drivers/net/wireless/rt2x00/rt61pci.c +++ b/drivers/net/wireless/rt2x00/rt61pci.c @@ -1978,13 +1978,14 @@ static void rt61pci_write_beacon(struct queue_entry *entry, struct queue_entry_priv_pci *entry_priv = entry->priv_data; unsigned int beacon_base; unsigned int padding_len; - u32 reg; + u32 orig_reg, reg; /* * Disable beaconing while we are reloading the beacon data, * otherwise we might be sending out invalid data. */ rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, ®); + orig_reg = reg; rt2x00_set_field32(®, TXRX_CSR9_BEACON_GEN, 0); rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg); @@ -2002,7 +2003,14 @@ static void rt61pci_write_beacon(struct queue_entry *entry, * Write entire beacon with descriptor and padding to register. */ padding_len = roundup(entry->skb->len, 4) - entry->skb->len; - skb_pad(entry->skb, padding_len); + if (padding_len && skb_pad(entry->skb, padding_len)) { + ERROR(rt2x00dev, "Failure padding beacon, aborting\n"); + /* skb freed by skb_pad() on failure */ + entry->skb = NULL; + rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, orig_reg); + return; + } + beacon_base = HW_BEACON_OFFSET(entry->entry_idx); rt2x00pci_register_multiwrite(rt2x00dev, beacon_base, entry_priv->desc, TXINFO_SIZE); |
