rt2x00: Check for errors from skb_pad() calls
Commit 739fd94
("rt2x00: Pad beacon to multiple of 32 bits")
added calls to skb_pad() without checking the return value,
which could cause problems if any of those calls does happen
to fail. Add checks to prevent this from happening.
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
a3dc5e881a
commit
d76dfc612b
|
@ -773,13 +773,14 @@ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
|
||||||
struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
|
struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
|
||||||
unsigned int beacon_base;
|
unsigned int beacon_base;
|
||||||
unsigned int padding_len;
|
unsigned int padding_len;
|
||||||
u32 reg;
|
u32 orig_reg, reg;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Disable beaconing while we are reloading the beacon data,
|
* Disable beaconing while we are reloading the beacon data,
|
||||||
* otherwise we might be sending out invalid data.
|
* otherwise we might be sending out invalid data.
|
||||||
*/
|
*/
|
||||||
rt2800_register_read(rt2x00dev, BCN_TIME_CFG, ®);
|
rt2800_register_read(rt2x00dev, BCN_TIME_CFG, ®);
|
||||||
|
orig_reg = reg;
|
||||||
rt2x00_set_field32(®, BCN_TIME_CFG_BEACON_GEN, 0);
|
rt2x00_set_field32(®, BCN_TIME_CFG_BEACON_GEN, 0);
|
||||||
rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
|
rt2800_register_write(rt2x00dev, BCN_TIME_CFG, reg);
|
||||||
|
|
||||||
|
@ -810,7 +811,14 @@ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
|
||||||
* Write entire beacon with TXWI and padding to register.
|
* Write entire beacon with TXWI and padding to register.
|
||||||
*/
|
*/
|
||||||
padding_len = roundup(entry->skb->len, 4) - entry->skb->len;
|
padding_len = roundup(entry->skb->len, 4) - entry->skb->len;
|
||||||
skb_pad(entry->skb, padding_len);
|
if (padding_len && skb_pad(entry->skb, padding_len)) {
|
||||||
|
ERROR(rt2x00dev, "Failure padding beacon, aborting\n");
|
||||||
|
/* skb freed by skb_pad() on failure */
|
||||||
|
entry->skb = NULL;
|
||||||
|
rt2800_register_write(rt2x00dev, BCN_TIME_CFG, orig_reg);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
|
beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
|
||||||
rt2800_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
|
rt2800_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
|
||||||
entry->skb->len + padding_len);
|
entry->skb->len + padding_len);
|
||||||
|
|
|
@ -1978,13 +1978,14 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
|
||||||
struct queue_entry_priv_pci *entry_priv = entry->priv_data;
|
struct queue_entry_priv_pci *entry_priv = entry->priv_data;
|
||||||
unsigned int beacon_base;
|
unsigned int beacon_base;
|
||||||
unsigned int padding_len;
|
unsigned int padding_len;
|
||||||
u32 reg;
|
u32 orig_reg, reg;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Disable beaconing while we are reloading the beacon data,
|
* Disable beaconing while we are reloading the beacon data,
|
||||||
* otherwise we might be sending out invalid data.
|
* otherwise we might be sending out invalid data.
|
||||||
*/
|
*/
|
||||||
rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, ®);
|
rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, ®);
|
||||||
|
orig_reg = reg;
|
||||||
rt2x00_set_field32(®, TXRX_CSR9_BEACON_GEN, 0);
|
rt2x00_set_field32(®, TXRX_CSR9_BEACON_GEN, 0);
|
||||||
rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
|
rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
|
||||||
|
|
||||||
|
@ -2002,7 +2003,14 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
|
||||||
* Write entire beacon with descriptor and padding to register.
|
* Write entire beacon with descriptor and padding to register.
|
||||||
*/
|
*/
|
||||||
padding_len = roundup(entry->skb->len, 4) - entry->skb->len;
|
padding_len = roundup(entry->skb->len, 4) - entry->skb->len;
|
||||||
skb_pad(entry->skb, padding_len);
|
if (padding_len && skb_pad(entry->skb, padding_len)) {
|
||||||
|
ERROR(rt2x00dev, "Failure padding beacon, aborting\n");
|
||||||
|
/* skb freed by skb_pad() on failure */
|
||||||
|
entry->skb = NULL;
|
||||||
|
rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, orig_reg);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
|
beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
|
||||||
rt2x00pci_register_multiwrite(rt2x00dev, beacon_base,
|
rt2x00pci_register_multiwrite(rt2x00dev, beacon_base,
|
||||||
entry_priv->desc, TXINFO_SIZE);
|
entry_priv->desc, TXINFO_SIZE);
|
||||||
|
|
|
@ -1533,13 +1533,14 @@ static void rt73usb_write_beacon(struct queue_entry *entry,
|
||||||
struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
|
struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
|
||||||
unsigned int beacon_base;
|
unsigned int beacon_base;
|
||||||
unsigned int padding_len;
|
unsigned int padding_len;
|
||||||
u32 reg;
|
u32 orig_reg, reg;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Disable beaconing while we are reloading the beacon data,
|
* Disable beaconing while we are reloading the beacon data,
|
||||||
* otherwise we might be sending out invalid data.
|
* otherwise we might be sending out invalid data.
|
||||||
*/
|
*/
|
||||||
rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, ®);
|
rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, ®);
|
||||||
|
orig_reg = reg;
|
||||||
rt2x00_set_field32(®, TXRX_CSR9_BEACON_GEN, 0);
|
rt2x00_set_field32(®, TXRX_CSR9_BEACON_GEN, 0);
|
||||||
rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
|
rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
|
||||||
|
|
||||||
|
@ -1563,7 +1564,14 @@ static void rt73usb_write_beacon(struct queue_entry *entry,
|
||||||
* Write entire beacon with descriptor and padding to register.
|
* Write entire beacon with descriptor and padding to register.
|
||||||
*/
|
*/
|
||||||
padding_len = roundup(entry->skb->len, 4) - entry->skb->len;
|
padding_len = roundup(entry->skb->len, 4) - entry->skb->len;
|
||||||
skb_pad(entry->skb, padding_len);
|
if (padding_len && skb_pad(entry->skb, padding_len)) {
|
||||||
|
ERROR(rt2x00dev, "Failure padding beacon, aborting\n");
|
||||||
|
/* skb freed by skb_pad() on failure */
|
||||||
|
entry->skb = NULL;
|
||||||
|
rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, orig_reg);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
|
beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
|
||||||
rt2x00usb_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
|
rt2x00usb_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
|
||||||
entry->skb->len + padding_len);
|
entry->skb->len + padding_len);
|
||||||
|
|
Loading…
Reference in a new issue