linux/drivers/net/wireless/p54
Jason Conti a6756da9ea p54: Initialize extra_len in p54_tx_80211
This patch fixes a very serious off-by-one bug in
the driver, which could leave the device in an
unresponsive state.

The problem was that the extra_len variable [used to
reserve extra scratch buffer space for the firmware]
was left uninitialized. Because p54_assign_address
later needs the value to reserve additional space,
the resulting frame could be to big for the small
device's memory window and everything would
immediately come to a grinding halt.

Reference: https://bugs.launchpad.net/bugs/722185

Cc: <stable@kernel.org>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Jason Conti <jason.conti@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-04-08 13:06:30 -04:00
..
eeprom.c p54: fix a NULL pointer dereference bug 2011-02-28 14:06:54 -05:00
eeprom.h p54: enhance rssi->dBm database import 2011-02-14 15:52:10 -05:00
fwio.c p54: implement set_coverage_class 2011-02-25 15:32:33 -05:00
Kconfig p54spi: Update kconfig help text 2011-03-07 13:51:04 -05:00
led.c drivers/net/wireless: Restore upper case words in wiphy_<level> messages 2010-08-18 16:37:44 -04:00
lmac.h mac80211: make tx() operation return void 2011-02-25 15:32:34 -05:00
main.c mac80211: make tx() operation return void 2011-02-25 15:32:34 -05:00
Makefile
net2280.h drivers/net: use __packed annotation 2010-06-03 03:18:23 -07:00
p54.h p54: implement set_coverage_class 2011-02-25 15:32:33 -05:00
p54pci.c p54pci: update receive dma buffers before and after processing 2011-02-21 15:17:51 -05:00
p54pci.h drivers/net: use __packed annotation 2010-06-03 03:18:23 -07:00
p54spi_eeprom.h p54spi: update sample eeprom 2011-02-14 15:52:10 -05:00
p54spi.c drivers: Final irq namespace conversion 2011-03-29 14:48:19 +02:00
p54spi.h drivers/net: use __packed annotation 2010-06-03 03:18:23 -07:00
p54usb.c p54usb: IDs for two new devices 2011-04-04 15:22:12 -04:00
p54usb.h drivers/net: use __packed annotation 2010-06-03 03:18:23 -07:00
txrx.c p54: Initialize extra_len in p54_tx_80211 2011-04-08 13:06:30 -04:00