From d7bafff3f94efd850f8744d683e63812ff8d55c5 Mon Sep 17 00:00:00 2001 From: Adam Baker Date: Sun, 3 Feb 2008 15:46:24 +0100 Subject: rt2x00: don't write past the end when writing short descriptors on rt61 The space allocated in the skb for a descriptor is only 24 bytes when setting up beacons in rt61 so make sure we don't write to the descriptor words beyond that and corrupt the beacon packet. Signed-off-by: Adam Baker Signed-off-by: Ivo van Doorn Signed-off-by: John W. Linville --- drivers/net/wireless/rt2x00/rt61pci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c index 547fa33e99d..5e08541958c 100644 --- a/drivers/net/wireless/rt2x00/rt61pci.c +++ b/drivers/net/wireless/rt2x00/rt61pci.c @@ -1531,9 +1531,11 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev, rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1); rt2x00_desc_write(txd, 5, word); - rt2x00_desc_read(txd, 11, &word); - rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skbdesc->data_len); - rt2x00_desc_write(txd, 11, word); + if (skbdesc->desc_len > TXINFO_SIZE) { + rt2x00_desc_read(txd, 11, &word); + rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skbdesc->data_len); + rt2x00_desc_write(txd, 11, word); + } rt2x00_desc_read(txd, 0, &word); rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1); -- cgit v1.2.3