From 522536f6b24e63ac946259af65224f107dff7857 Mon Sep 17 00:00:00 2001 From: Larry Finger Date: Wed, 28 Jun 2006 19:11:21 -0500 Subject: [PATCH 1/2] [PATCH] bcm43xx-softmac: Fix an off-by-one condition in handle_irq_noise An assert statement near the start of handle_irq_noise in the softmac version of bcm43xx_main.c is there to protect against out of bound addressing using variable bcm->noisecalc.nr_samples. The arrays in question have a dimension of 8, thus the value must be < 8. Signed-Off-By: Larry.Finger Signed-off-by: John W. Linville --- drivers/net/wireless/bcm43xx/bcm43xx_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c index e1c5a939bca4..3889f79e7128 100644 --- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c +++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c @@ -1547,7 +1547,7 @@ static void handle_irq_noise(struct bcm43xx_private *bcm) goto generate_new; /* Get the noise samples. */ - assert(bcm->noisecalc.nr_samples <= 8); + assert(bcm->noisecalc.nr_samples < 8); i = bcm->noisecalc.nr_samples; noise[0] = limit_value(noise[0], 0, ARRAY_SIZE(radio->nrssi_lt) - 1); noise[1] = limit_value(noise[1], 0, ARRAY_SIZE(radio->nrssi_lt) - 1); From b312d799b324e895745ffe148def234fc60d5b74 Mon Sep 17 00:00:00 2001 From: Daniel Drake Date: Wed, 5 Jul 2006 15:57:39 +0100 Subject: [PATCH 2/2] [PATCH] zd1211rw: usb_clear_halt not allowed in IRQ context We will reimplement halt-clearing later, when we have periodic housekeeping routines in place. This will do as a temporary fix, the EPIPE case has not yet been seen. Signed-off-by: Daniel Drake Signed-off-by: John W. Linville --- drivers/net/wireless/zd1211rw/zd_usb.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c index ce1cb2c6aa8d..72f90525bf68 100644 --- a/drivers/net/wireless/zd1211rw/zd_usb.c +++ b/drivers/net/wireless/zd1211rw/zd_usb.c @@ -375,10 +375,8 @@ static void int_urb_complete(struct urb *urb, struct pt_regs *pt_regs) case -ENODEV: case -ENOENT: case -ECONNRESET: - goto kfree; case -EPIPE: - usb_clear_halt(urb->dev, EP_INT_IN); - /* FALL-THROUGH */ + goto kfree; default: goto resubmit; } @@ -580,10 +578,8 @@ static void rx_urb_complete(struct urb *urb, struct pt_regs *pt_regs) case -ENODEV: case -ENOENT: case -ECONNRESET: - return; case -EPIPE: - usb_clear_halt(urb->dev, EP_DATA_IN); - /* FALL-THROUGH */ + return; default: dev_dbg_f(urb_dev(urb), "urb %p error %d\n", urb, urb->status); goto resubmit; @@ -749,11 +745,9 @@ static void tx_urb_complete(struct urb *urb, struct pt_regs *pt_regs) case -ENODEV: case -ENOENT: case -ECONNRESET: + case -EPIPE: dev_dbg_f(urb_dev(urb), "urb %p error %d\n", urb, urb->status); break; - case -EPIPE: - usb_clear_halt(urb->dev, EP_DATA_OUT); - /* FALL-THROUGH */ default: dev_dbg_f(urb_dev(urb), "urb %p error %d\n", urb, urb->status); goto resubmit;