aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2011-04-06 15:28:56 -0400
committerWey-Yi Guy <wey-yi.w.guy@intel.com>2011-04-18 12:26:12 -0400
commitb4ebd28f23e3ae00af886aff1c00f800dee3b080 (patch)
tree379aa929d790e40f2b50ef97e5ee5d1b222544d5 /drivers/net/wireless
parent7b21f00ee6073909c01adeba317af3d78c3b9d0a (diff)
iwlagn: use huge command for beacon
When testing some new P2P code, Angie found that the driver might crash because the beacon command ended up being bigger than a regular command. This is quite obvious -- a normal command is limited to roughly 360 bytes but a beacon may be much larger of course. To fix this, use the huge command buffer. Reported-by: Angie Chinchilla <angie.v.chinchilla@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Diffstat (limited to 'drivers/net/wireless')
-rw-r--r--drivers/net/wireless/iwlwifi/iwl-agn.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 0daededb0ff2..3cfd7ebb3448 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -253,6 +253,10 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
253 struct iwl_frame *frame; 253 struct iwl_frame *frame;
254 unsigned int frame_size; 254 unsigned int frame_size;
255 int rc; 255 int rc;
256 struct iwl_host_cmd cmd = {
257 .id = REPLY_TX_BEACON,
258 .flags = CMD_SIZE_HUGE,
259 };
256 260
257 frame = iwl_get_free_frame(priv); 261 frame = iwl_get_free_frame(priv);
258 if (!frame) { 262 if (!frame) {
@@ -268,8 +272,10 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
268 return -EINVAL; 272 return -EINVAL;
269 } 273 }
270 274
271 rc = iwl_send_cmd_pdu(priv, REPLY_TX_BEACON, frame_size, 275 cmd.len = frame_size;
272 &frame->u.cmd[0]); 276 cmd.data = &frame->u.cmd[0];
277
278 rc = iwl_send_cmd_sync(priv, &cmd);
273 279
274 iwl_free_frame(priv, frame); 280 iwl_free_frame(priv, frame);
275 281