diff options
author | Johannes Berg <johannes.berg@intel.com> | 2011-04-06 15:28:56 -0400 |
---|---|---|
committer | Wey-Yi Guy <wey-yi.w.guy@intel.com> | 2011-04-18 12:26:12 -0400 |
commit | b4ebd28f23e3ae00af886aff1c00f800dee3b080 (patch) | |
tree | 379aa929d790e40f2b50ef97e5ee5d1b222544d5 /drivers/net/wireless | |
parent | 7b21f00ee6073909c01adeba317af3d78c3b9d0a (diff) |
iwlagn: use huge command for beacon
When testing some new P2P code, Angie found that the
driver might crash because the beacon command ended
up being bigger than a regular command. This is quite
obvious -- a normal command is limited to roughly 360
bytes but a beacon may be much larger of course.
To fix this, use the huge command buffer.
Reported-by: Angie Chinchilla <angie.v.chinchilla@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Diffstat (limited to 'drivers/net/wireless')
-rw-r--r-- | drivers/net/wireless/iwlwifi/iwl-agn.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c index 0daededb0ff2..3cfd7ebb3448 100644 --- a/drivers/net/wireless/iwlwifi/iwl-agn.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn.c | |||
@@ -253,6 +253,10 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv) | |||
253 | struct iwl_frame *frame; | 253 | struct iwl_frame *frame; |
254 | unsigned int frame_size; | 254 | unsigned int frame_size; |
255 | int rc; | 255 | int rc; |
256 | struct iwl_host_cmd cmd = { | ||
257 | .id = REPLY_TX_BEACON, | ||
258 | .flags = CMD_SIZE_HUGE, | ||
259 | }; | ||
256 | 260 | ||
257 | frame = iwl_get_free_frame(priv); | 261 | frame = iwl_get_free_frame(priv); |
258 | if (!frame) { | 262 | if (!frame) { |
@@ -268,8 +272,10 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv) | |||
268 | return -EINVAL; | 272 | return -EINVAL; |
269 | } | 273 | } |
270 | 274 | ||
271 | rc = iwl_send_cmd_pdu(priv, REPLY_TX_BEACON, frame_size, | 275 | cmd.len = frame_size; |
272 | &frame->u.cmd[0]); | 276 | cmd.data = &frame->u.cmd[0]; |
277 | |||
278 | rc = iwl_send_cmd_sync(priv, &cmd); | ||
273 | 279 | ||
274 | iwl_free_frame(priv, frame); | 280 | iwl_free_frame(priv, frame); |
275 | 281 | ||