lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

rt2x00: Properly reserve room for descriptors in skbs.

Browse Source 
Instead of fiddling with the skb->data pointer and thereby risking
out of bounds accesses, properly reserve the space needed in an
skb for descriptors.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
This commit is contained in:
Gertjan van Wingerde
2010-06-03 10:51:45 +02:00
committed by Ivo van Doorn
parent baaffe67b5
commit 0b8004aa12
16 changed files with 109 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/net/wireless/rt2x00/rt2x00usb.c
View File

@ -197,6 +197,11 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
!test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
return;
/*
* Remove the descriptor from the front of the skb.
*/
skb_pull(entry->skb, entry->queue->desc_size);
/*
* Obtain the status about this packet.
* Note that when the status is 0 it does not mean the
@ -242,12 +247,6 @@ int rt2x00usb_write_tx_data(struct queue_entry *entry,
entry->skb->data, length,
rt2x00usb_interrupt_txdone, entry);
/*
* Make sure the skb->data pointer points to the frame, not the
* descriptor.
*/
skb_pull(entry->skb, entry->queue->desc_size);
/*
* Call the driver's write_tx_datadesc function, if it exists.
*/