diff options
| author | Adrien Schildknecht <adrien+dev@schischi.me> | 2015-08-11 00:25:53 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2015-08-18 09:04:45 +0300 |
| commit | f10746fef3dfa8546808989f71c3543db832f374 (patch) | |
| tree | 3f69229be0f8e78cc603c1ec4f8cd6125143663c /drivers/net/wireless/rt2x00 | |
| parent | bafc6e4cd897ef14015d8d32a04ee9bfa8d91370 (diff) | |
| download | op-kernel-dev-f10746fef3dfa8546808989f71c3543db832f374.zip op-kernel-dev-f10746fef3dfa8546808989f71c3543db832f374.tar.gz | |
rt2x00: adjust EEPROM_SIZE for rt2500usb
rt2500usb_validate_eeprom() read data up to 0x6e (EEPROM_CALIBRATE_OFFSET)
but only 0x6a bytes has been allocated and read from the eeprom.
This lead to out-of-bound accesses and invalid values for
EEPROM_BBPTUNE_R17 and EEPROM_CALIBRATE_OFFSET.
Change the EEPROM_SIZE to 0x6e in order to retrieve all the fields.
Tested with a rt2570 device.
Signed-off-by: Adrien Schildknecht <adrien+dev@schischi.me>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/rt2x00')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt2500usb.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h index afba073..78cc035 100644 --- a/drivers/net/wireless/rt2x00/rt2500usb.h +++ b/drivers/net/wireless/rt2x00/rt2500usb.h @@ -54,7 +54,7 @@ #define CSR_REG_BASE 0x0400 #define CSR_REG_SIZE 0x0100 #define EEPROM_BASE 0x0000 -#define EEPROM_SIZE 0x006a +#define EEPROM_SIZE 0x006e #define BBP_BASE 0x0000 #define BBP_SIZE 0x0060 #define RF_BASE 0x0004 |
