Skip to contentSkip to conversation

ieee80211: Fix kernel panic when QoS is enabled

PATCH New Zhu Yi 1 participant 1 message Nov 13, 2006

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Zhu Yi

author
#0 lore raw

PATCH 1/1 ieee80211: Fix kernel panic when QoS is enabled

The 802.11 header length is affected by the wireless mode (WDS or not) and type (QoS or not). We should use the variable hdr_len instead of the hard coded IEEE80211_3ADDR_LEN, otherwise we may touch invalid memory.

Signed-off-by Zhu Yi <[email protected]>

---

 net/ieee80211/ieee80211_tx.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

97f244c8efd9a30f0e63e71709ee0142e85307f6

net/ieee80211/ieee80211_tx.c +2 -2
index ae25449..854fc13 100644
@@ -390,7 +390,7 @@ int ieee80211_xmit(struct sk_buff *skb, 
 		 * this stack is providing the full 802.11 header, one will
 		 * eventually be affixed to this fragment -- so we must account
 		 * for it when determining the amount of payload space. */
-		bytes_per_frag = frag_size - IEEE80211_3ADDR_LEN;
+		bytes_per_frag = frag_size - hdr_len;
 		if (ieee->config &
 		    (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
 			bytes_per_frag -= IEEE80211_FCS_LEN;

@@ -412,7 +412,7 @@ int ieee80211_xmit(struct sk_buff *skb, 
 	} else {
 		nr_frags = 1;
 		bytes_per_frag = bytes_last_frag = bytes;
-		frag_size = bytes + IEEE80211_3ADDR_LEN;
+		frag_size = bytes + hdr_len;
 	}
 
 	rts_required = (frag_size > ieee->rts
Signature · 1 line
1.2.6