diff options
| author | Gertjan van Wingerde <gwingerde@gmail.com> | 2010-06-03 10:51:45 +0200 |
|---|---|---|
| committer | Ivo van Doorn <IvDoorn@gmail.com> | 2010-06-03 10:51:45 +0200 |
| commit | 0b8004aa12d13ec750d102ba4082a95f0107c649 (patch) | |
| tree | eac5224159d34ae525b552254816c3a1e056336c /drivers/net/wireless/rt2x00/rt2x00usb.c | |
| parent | rt2x00: Reverse calling order of bus write_tx_desc and driver write_tx_desc. (diff) | |
| download | linux-0b8004aa12d13ec750d102ba4082a95f0107c649.tar.xz linux-0b8004aa12d13ec750d102ba4082a95f0107c649.zip | |
rt2x00: Properly reserve room for descriptors in skbs.
Instead of fiddling with the skb->data pointer and thereby risking
out of bounds accesses, properly reserve the space needed in an
skb for descriptors.
Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Diffstat (limited to 'drivers/net/wireless/rt2x00/rt2x00usb.c')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt2x00usb.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c index 25cc376d388e..5e123519f8cb 100644 --- a/drivers/net/wireless/rt2x00/rt2x00usb.c +++ b/drivers/net/wireless/rt2x00/rt2x00usb.c @@ -198,6 +198,11 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb) return; /* + * Remove the descriptor from the front of the skb. + */ + skb_pull(entry->skb, entry->queue->desc_size); + + /* * Obtain the status about this packet. * Note that when the status is 0 it does not mean the * frame was send out correctly. It only means the frame @@ -243,12 +248,6 @@ int rt2x00usb_write_tx_data(struct queue_entry *entry, rt2x00usb_interrupt_txdone, entry); /* - * Make sure the skb->data pointer points to the frame, not the - * descriptor. - */ - skb_pull(entry->skb, entry->queue->desc_size); - - /* * Call the driver's write_tx_datadesc function, if it exists. */ if (rt2x00dev->ops->lib->write_tx_datadesc) |