Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=977b143c13e685081625704ac356b741d71c6a73
Commit: 977b143c13e685081625704ac356b741d71c6a73
Parent: 8524f59d4735e1ff9c9dc3e09ebcc7bdb3b32b7b
Author: Al Viro <[EMAIL PROTECTED]>
AuthorDate: Wed Dec 19 16:45:29 2007 -0500
Committer: David S. Miller <[EMAIL PROTECTED]>
CommitDate: Mon Jan 28 15:08:49 2008 -0800
airo: fix transmit_802_11_packet()
a) gaplen would better be stored little-endian
b) for control packets (shorter than 24-byte header) we ended up with
bap_write(ai, hdrlen == 30 ?
(const u16*)&gap.gaplen : (const u16*)&gap, 38 - hdrlen,
BAP1);
passing to card the data past the end of gap (i.e. random stuff from stack)
and did _not_ feed the gaplen at the right offset.
c) sending the contents of uninitialized fields of struct is Not Nice(tm)
either
Signed-off-by: Al Viro <[EMAIL PROTECTED]>
Signed-off-by: John W. Linville <[EMAIL PROTECTED]>
---
drivers/net/wireless/airo.c | 11 +++--------
1 files changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index be9aa4e..24fa0d6 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -4365,14 +4365,10 @@ static int transmit_802_11_packet(struct airo_info *ai,
int len, char *pPacket)
Cmd cmd;
Resp rsp;
int hdrlen;
- struct {
- u8 addr4[ETH_ALEN];
- u16 gaplen;
- u8 gap[6];
- } gap;
+ static u8 tail[(30-10) + 2 + 6] = {[30-10] = 6};
+ /* padding of header to full size + le16 gaplen (6) + gaplen bytes */
u16 txFid = len;
len >>= 16;
- gap.gaplen = 6;
fc = le16_to_cpu(*(const u16*)pPacket);
switch (fc & 0xc) {
@@ -4405,8 +4401,7 @@ static int transmit_802_11_packet(struct airo_info *ai,
int len, char *pPacket)
bap_write(ai, &payloadLen, sizeof(payloadLen),BAP1);
if (bap_setup(ai, txFid, 0x0014, BAP1) != SUCCESS) return ERROR;
bap_write(ai, (const u16*)pPacket, hdrlen, BAP1);
- bap_write(ai, hdrlen == 30 ?
- (const u16*)&gap.gaplen : (const u16*)&gap, 38 - hdrlen, BAP1);
+ bap_write(ai, (u16 *)(tail + (hdrlen - 10)), 38 - hdrlen, BAP1);
bap_write(ai, (const u16*)(pPacket + hdrlen), len - hdrlen, BAP1);
// issue the transmit command
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
