aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorGertjan van Wingerde <gwingerde@gmail.com>2010-05-11 17:51:38 -0400
committerJohn W. Linville <linville@tuxdriver.com>2010-05-12 16:41:43 -0400
commit6b97cb04f2766513c57b57f8ac4b44915296230f (patch)
tree65e3c80e011b5268588a75a908c7cffca67516fc /drivers/net
parent878f7045d8ae24f5a9e3a8a7ee5c33d30c30a553 (diff)
rt2x00: Fix beacon descriptor writing for rt61pci.
The buffer address descriptor word is not part of the TXINFO structure needed for beacons. The current writing of that word for beacons is therefore an out-of-bounds write. Fix this by only writing the buffer address descriptor word for TX queues. Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com> Acked-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/wireless/rt2x00/rt61pci.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 24363634e6fd..99c298100fb6 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1801,12 +1801,12 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
1801 rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1); 1801 rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
1802 rt2x00_desc_write(txd, 5, word); 1802 rt2x00_desc_write(txd, 5, word);
1803 1803
1804 rt2x00_desc_read(txd, 6, &word); 1804 if (txdesc->queue != QID_BEACON) {
1805 rt2x00_set_field32(&word, TXD_W6_BUFFER_PHYSICAL_ADDRESS, 1805 rt2x00_desc_read(txd, 6, &word);
1806 skbdesc->skb_dma); 1806 rt2x00_set_field32(&word, TXD_W6_BUFFER_PHYSICAL_ADDRESS,
1807 rt2x00_desc_write(txd, 6, word); 1807 skbdesc->skb_dma);
1808 rt2x00_desc_write(txd, 6, word);
1808 1809
1809 if (skbdesc->desc_len > TXINFO_SIZE) {
1810 rt2x00_desc_read(txd, 11, &word); 1810 rt2x00_desc_read(txd, 11, &word);
1811 rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, 1811 rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0,
1812 txdesc->length); 1812 txdesc->length);