summaryrefslogtreecommitdiff
path: root/net/ieee80211
diff options
context:
space:
mode:
authorZhu Yi <yi.zhu@intel.com>2006-11-13 11:32:50 +0800
committerJohn W. Linville <linville@tuxdriver.com>2006-11-14 19:31:48 -0500
commitefa53ebe0d2f50bf342eb1976824f59bba9941eb (patch)
tree41b68cfbf14a5540948df806c2a60999627a669c /net/ieee80211
parent0579e303553655245e8a6616bd8b4428b07d63a2 (diff)
downloadlinux-3.10-efa53ebe0d2f50bf342eb1976824f59bba9941eb.tar.gz
linux-3.10-efa53ebe0d2f50bf342eb1976824f59bba9941eb.tar.bz2
linux-3.10-efa53ebe0d2f50bf342eb1976824f59bba9941eb.zip
[PATCH] ieee80211: Fix kernel panic when QoS is enabled
The 802.11 header length is affected by the wireless mode (WDS or not) and type (QoS or not). We should use the variable hdr_len instead of the hard coded IEEE80211_3ADDR_LEN, otherwise we may touch invalid memory. Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/ieee80211')
-rw-r--r--net/ieee80211/ieee80211_tx.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ieee80211/ieee80211_tx.c b/net/ieee80211/ieee80211_tx.c
index ae254497ba3..854fc13cd78 100644
--- a/net/ieee80211/ieee80211_tx.c
+++ b/net/ieee80211/ieee80211_tx.c
@@ -390,7 +390,7 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
* this stack is providing the full 802.11 header, one will
* eventually be affixed to this fragment -- so we must account
* for it when determining the amount of payload space. */
- bytes_per_frag = frag_size - IEEE80211_3ADDR_LEN;
+ bytes_per_frag = frag_size - hdr_len;
if (ieee->config &
(CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
bytes_per_frag -= IEEE80211_FCS_LEN;
@@ -412,7 +412,7 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
} else {
nr_frags = 1;
bytes_per_frag = bytes_last_frag = bytes;
- frag_size = bytes + IEEE80211_3ADDR_LEN;
+ frag_size = bytes + hdr_len;
}
rts_required = (frag_size > ieee->rts