linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ivo van Doorn <ivdoorn@gmail.com>
To: "John W. Linville" <linville@tuxdriver.com>
Cc: linux-wireless@vger.kernel.org, rt2400-devel@lists.sourceforge.net
Subject: [PATCH 18/30] rt2x00: memset descriptor before use
Date: Sun, 19 Aug 2007 20:27:54 +0200	[thread overview]
Message-ID: <200708192027.54448.IvDoorn@gmail.com> (raw)
In-Reply-To: <200708192018.30624.IvDoorn@gmail.com>

>From 1273bba4e38352cfe5b15c1c7cad742e41f00a96 Mon Sep 17 00:00:00 2001
From: Ivo van Doorn <IvDoorn@gmail.com>
Date: Sat, 18 Aug 2007 13:08:49 +0200
Subject: [PATCH 18/30] rt2x00: memset descriptor before use

For rt2x00usb, when skb_push() is called the descriptor is added
in front of the frame. The contents however is random data.
This should be correctly cleared to prevent garbage to be send to
the device...

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
---
 drivers/net/wireless/rt2x00usb.c |   10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/rt2x00usb.c b/drivers/net/wireless/rt2x00usb.c
index d832d5f..c763606 100644
--- a/drivers/net/wireless/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00usb.c
@@ -268,7 +268,6 @@ int rt2x00usb_write_tx_data(struct rt2x00_dev *rt2x00dev,
 	    interface_to_usbdev(rt2x00dev_usb(rt2x00dev));
 	struct ieee80211_hdr *ieee80211hdr = (struct ieee80211_hdr *)skb->data;
 	struct data_entry *entry = rt2x00_get_data_entry(ring);
-	struct data_desc *txd;
 	u32 length = skb->len;
 
 	if (rt2x00_ring_full(ring)) {
@@ -285,9 +284,14 @@ int rt2x00usb_write_tx_data(struct rt2x00_dev *rt2x00dev,
 		return -EINVAL;
 	}
 
+	/*
+	 * Add the descriptor in front of the skb.
+	 */
 	skb_push(skb, rt2x00dev->hw->extra_tx_headroom);
-	txd = (struct data_desc *)skb->data;
-	rt2x00lib_write_tx_desc(rt2x00dev, entry, txd, ieee80211hdr,
+	memset(skb->data, 0x00, rt2x00dev->hw->extra_tx_headroom);
+
+	rt2x00lib_write_tx_desc(rt2x00dev, entry,
+				(struct data_desc *)skb->data, ieee80211hdr,
 				length, control);
 	memcpy(&entry->tx_status.control, control, sizeof(*control));
 	entry->skb = skb;
-- 
1.5.3.rc5


  parent reply	other threads:[~2007-08-19 18:31 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-08-19 18:18 Please pull 'upstream' branch of rt2x00 Ivo van Doorn
2007-08-19 18:21 ` [PATCH 01/30] rt2x00: Correctly configure packet filter in monitor mode Ivo van Doorn
2007-08-19 18:21 ` [PATCH 02/30] rt2x00: Clear MAC and BSSID when non-monitor interface goes down Ivo van Doorn
2007-08-19 18:21 ` [PATCH 03/30] rt2x00: Check return value of usb_control_msg() Ivo van Doorn
2007-08-19 18:22 ` [PATCH 04/30] rt2x00: Clear all fields on start_link_tune() Ivo van Doorn
2007-08-19 18:22 ` [PATCH 05/30] rt2x00: Don't increase rx_failed for individual frames Ivo van Doorn
2007-08-19 18:23 ` [PATCH 06/30] rt2x00: Set vgc_level during reset_tuner Ivo van Doorn
2007-08-19 18:23 ` [PATCH 07/30] rt2x00: Schedule beacon update Ivo van Doorn
2007-08-19 18:24 ` [PATCH 08/30] rt2x00: Fix width of filter field Ivo van Doorn
2007-08-19 18:24 ` [PATCH 09/30] rt2x00: Be consistent with unsigned Ivo van Doorn
2007-08-19 18:24 ` [PATCH 10/30] rt2x00: Correctly reset TX/RX success/failed counters Ivo van Doorn
2007-08-19 18:25 ` [PATCH 11/30] rt2x00: Rework RF register handling Ivo van Doorn
2007-08-19 18:25 ` [PATCH 12/30] rt2x00: Store firmware in memory Ivo van Doorn
2007-08-19 18:54   ` Michael Buesch
2007-08-19 20:44     ` Ivo van Doorn
2007-08-19 18:26 ` [PATCH 13/30] rt2x00: rt2x00_ring_free returns invalid length Ivo van Doorn
2007-08-19 18:26 ` [PATCH 14/30] Fix off-by-one error in debugfs helpers Ivo van Doorn
2007-08-19 18:26 ` [PATCH 15/30] rt2x00: Use caching for USB transfers Ivo van Doorn
2007-08-19 18:27 ` [PATCH 16/30] rt2x00: Cleanup set_state for rt61 and rt73 Ivo van Doorn
2007-08-19 18:27 ` [PATCH 17/30] rt2x00: Fix register initialization ordering Ivo van Doorn
2007-08-19 18:27 ` Ivo van Doorn [this message]
2007-08-19 18:28 ` [PATCH 19/30] rt2x00: Remove IEEE80211_HW_WEP_INCLUDE_IV flag Ivo van Doorn
2007-08-19 18:28 ` [PATCH 20/30] rt2x00: Cleanup TXD flags Ivo van Doorn
2007-08-19 18:28 ` [PATCH 21/30] rt2x00: Add byte-ordering annotation for MAC and BSSID Ivo van Doorn
2007-08-19 18:29 ` [PATCH 22/30] rt2x00: Correctly set TXD retry flag Ivo van Doorn
2007-08-19 18:35 ` [PATCH 23/30] rt2x00: Move rt2x00 files into rt2x00 folder Ivo van Doorn
2007-08-19 18:35 ` [PATCH 24/30] rt2x00: Add file pattern to MAINTAINER entry Ivo van Doorn
2007-08-19 18:35 ` [PATCH 25/30] rt2x00: Fix PLCP setup Ivo van Doorn
2007-08-19 18:36 ` [PATCH 26/30] rt2x00: Clean up RATEMASK handling Ivo van Doorn
2007-08-19 18:36 ` [PATCH 27/30] rt2x00: Add rt2x00lib_reset_link_tuner() Ivo van Doorn
2007-08-19 18:36 ` [PATCH 28/30] rt2x00: Always check if mac80211 requested TX status update Ivo van Doorn
2007-08-20 17:21   ` Johannes Berg
2007-08-21 10:21     ` Ivo van Doorn
2007-08-19 18:36 ` [PATCH 29/30] rt2x00: Lindent Ivo van Doorn
2007-08-19 18:37 ` [PATCH 30/30] rt2x00: rt2x00 2.0.7 Ivo van Doorn
2007-08-23 20:55 ` [Rt2400-devel] Please pull 'upstream' branch of rt2x00 John W. Linville

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200708192027.54448.IvDoorn@gmail.com \
    --to=ivdoorn@gmail.com \
    --cc=linux-wireless@vger.kernel.org \
    --cc=linville@tuxdriver.com \
    --cc=rt2400-devel@lists.sourceforge.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).