summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* vlan: Rename VLAN_GROUP_ARRAY_LEN to VLAN_N_VID.Jesse Gross2010-10-2116-27/+27
| | | | | | | | | | VLAN_GROUP_ARRAY_LEN is simply the number of possible vlan VIDs. Since vlan groups will soon be more of an implementation detail for vlan devices, rename the constant to be descriptive of its actual purpose. Signed-off-by: Jesse Gross <jesse@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ebtables: Allow filtering of hardware accelerated vlan frames.Jesse Gross2010-10-213-18/+34
| | | | | | | | | | An upcoming commit will allow packets with hardware vlan acceleration information to be passed though more parts of the network stack, including packets trunked through the bridge. This adds support for matching and filtering those packets through ebtables. Signed-off-by: Jesse Gross <jesse@nicira.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* enic: Fix log messageVasanthy Kolluri2010-10-211-1/+1
| | | | | | | | | Fix a log message Signed-off-by: Vasanthy Kolluri <vkolluri@cisco.com> Signed-off-by: Roopa Prabhu <roprabhu@cisco.com> Signed-off-by: David Wang <dwang2@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* enic: Change min MTUVasanthy Kolluri2010-10-211-1/+1
| | | | | | | | | Change min MTU to 68. Signed-off-by: Vasanthy Kolluri <vkolluri@cisco.com> Signed-off-by: Roopa Prabhu <roprabhu@cisco.com> Signed-off-by: David Wang <dwang2@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* enic: Replace firmware devcmd CMD_ENABLE with CMD_ENABLE_WAITVasanthy Kolluri2010-10-213-4/+10
| | | | | | | | | Replace no wait CMD_ENABLE firmware devcmd with CMD_ENABLE_WAIT Signed-off-by: Vasanthy Kolluri <vkolluri@cisco.com> Signed-off-by: Roopa Prabhu <roprabhu@cisco.com> Signed-off-by: David Wang <dwang2@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* enic: Make firmware cognizant of the user set mac addressVasanthy Kolluri2010-10-211-1/+12
| | | | | | | | | Let the firmware know about the mac address set by the user using ndo_set_mac_address Signed-off-by: Vasanthy Kolluri <vkolluri@cisco.com> Signed-off-by: Roopa Prabhu <roprabhu@cisco.com> Signed-off-by: David Wang <dwang2@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* enic: Add support for multiple hardware receive queuesVasanthy Kolluri2010-10-215-124/+368
| | | | | | | | | Add support for multiple hardware receive queues. The ingress traffic is hashed into one of the receive queues based on IP or TCP or both headers. The max no. of receive queues supported is 8. Signed-off-by: Vasanthy Kolluri <vkolluri@cisco.com> Signed-off-by: Roopa Prabhu <roprabhu@cisco.com> Signed-off-by: David Wang <dwang2@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* ibmveth: Free irq on error pathDenis Kirjanov2010-10-211-2/+4
| | | | | | | Free irq on error path. Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* ibmveth: Cleanup error handling inside ibmveth_openDenis Kirjanov2010-10-211-24/+20
| | | | | | | Remove duplicated code in one place. Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: avoid RCU for NOCACHE dstEric Dumazet2010-10-203-19/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is no point using RCU for dst we allocate for a very short time (used once). Change dst_release() to take DST_NOCACHE into account, but also change skb_dst_set_noref() to force a refcount increment for such dst. This is a _huge_ gain, because we dont waste memory to store xx thousand of dsts. Instead of queueing them to RCU, we can free them instantly. CPU caches can stay hot, re-using same memory blocks to hold temporary dsts. Note : remove unneeded smp_mb__before_atomic_dec(); in dst_release(), since atomic_dec_return() implies a full memory barrier. Stress test, 160.000.000 udp frames sent, IP route cache disabled (DDOS). Before: real 0m38.091s user 0m13.189s sys 7m53.018s After: real 0m29.946s user 0m12.157s sys 7m40.605s For reference, if IP route cache was enabled : real 0m32.030s user 0m10.521s sys 8m15.243s Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: allocate tx queues in register_netdeviceTom Herbert2010-10-202-55/+55
| | | | | | | | | | | | | This patch introduces netif_alloc_netdev_queues which is called from register_device instead of alloc_netdev_mq. This makes TX queue allocation symmetric with RX allocation. Also, queue locks allocation is done in netdev_init_one_queue. Change set_real_num_tx_queues to fail if requested number < 1 or greater than number of allocated queues. Signed-off-by: Tom Herbert <therbert@google.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: cleanups in RX queue allocationTom Herbert2010-10-201-19/+17
| | | | | | | | | | | Clean up in RX queue allocation. In netif_set_real_num_rx_queues return error on attempt to set zero queues, or requested number is greater than number of allocated queues. In netif_alloc_rx_queues, do BUG_ON if queue_count is zero. Signed-off-by: Tom Herbert <therbert@google.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* net: fail alloc_netdev_mq if queue count < 1Tom Herbert2010-10-201-0/+6
| | | | | | | | In alloc_netdev_mq fail if requested queue_count < 1. Signed-off-by: Tom Herbert <therbert@google.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'for-davem' of ↵David S. Miller2010-10-20169-6552/+5490
|\ | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6
| * Merge branch 'master' of ↵John W. Linville2010-10-15151-6383/+5272
| |\ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem
| | * drivers/net/wireless/p54/eeprom.c: Return -ENOMEM on memory allocation failureJulia Lawall2010-10-151-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In this code, 0 is returned on memory allocation failure, even though other failures return -ENOMEM or other similar values. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression ret; expression x,e1,e2,e3; @@ ret = 0 ... when != ret = e1 *x = \(kmalloc\|kcalloc\|kzalloc\)(...) ... when != ret = e2 if (x == NULL) { ... when != ret = e3 return ret; } // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Cc: <stable@kernel.org> Acked-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: Null out references to stale pointers.Ben Greear2010-10-153-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | This doesn't fix any problem that I'm aware of, but should make it harder to add use-after-free type bugs in the future. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: Remove bf_dmacontext.Ben Greear2010-10-154-20/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | The bf_dmacontext seems to be totally useless and duplicated by bf_buf_addr. Remove it entirely, use bf_buf_addr in its place. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * b43: N-PHY: put 2056-radio's specific code in separated fileRafał Miłecki2010-10-156-30/+88
| | | | | | | | | | | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k_hw: remove AR9003 2.0 supportLuis R. Rodriguez2010-10-153-1923/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These chipsets will not hit the market, all customers will be on >= AR9003 2.2. This shaves down the ath9k_hw size by 24161 bytes (24 KB) on my system. Before: $ size drivers/net/wireless/ath/ath9k/ath9k_hw.ko text data bss dec hex filename 292328 616 1824 294768 47f70 drivers/net/wireless/ath/ath9k/ath9k_hw.ko $ du -b drivers/net/wireless/ath/ath9k/ath9k_hw.ko 5987825 drivers/net/wireless/ath/ath9k/ath9k_hw.ko After: $ size drivers/net/wireless/ath/ath9k/ath9k_hw.ko text data bss dec hex filename 277192 616 1824 279632 44450 drivers/net/wireless/ath/ath9k/ath9k_hw.ko $ du -b drivers/net/wireless/ath/ath9k/ath9k_hw.ko 5963664 drivers/net/wireless/ath/ath9k/ath9k_hw.ko Cc: Yixiang Li <yixiang.li@atheros.com> Cc: Don Breslin <don.breslin@atheros.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * b43: N-PHY: put radio-specific code in separated fileRafał Miłecki2010-10-157-1563/+1588
| | | | | | | | | | | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * b43: N-PHY: fix typo: read table when caching IQ LO calibration (do not write)Rafał Miłecki2010-10-151-1/+1
| | | | | | | | | | | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * b43: N-PHY: replace N-specific radio_chanspec with common codeRafał Miłecki2010-10-153-37/+26
| | | | | | | | | | | | | | | Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * radiotap: fix vendor namespace parsingJohannes Berg2010-10-151-26/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's a bug with radiotap vendor namespace parsing if you don't register for the given namespace extensions. Fix this by passing only the unknown vendor namespaces and the registered data to frontends, but not both. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k_htc: set probe request rx filterRajkumar Manoharan2010-10-152-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | This patch enables to receive probe request frames on p2p client mode. Signed-off-by: Rajkumar Manoharan <rmanoharan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * libertas: Communicate USB transfer errorsPaul Fox2010-10-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The return code was being overwritten with -1. Useful for debugging. Signed-off-by: Paul Fox <pgf@laptop.org> Signed-off-by: Daniel Drake <dsd@laptop.org> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k_hw: remove enum wireless_mode and its usersFelix Fietkau2010-10-155-89/+25
| | | | | | | | | | | | | | | | | | | | | | | | The wireless mode bitfield was only used to detect 2.4 and 5 GHz support, which can be simplified by using ATH9K_HW_CAP_* capabilities. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: remove sc->cur_rate_table and sc->cur_rate_modeFelix Fietkau2010-10-153-53/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | Set the rate table in the rc module properly based on band and HT capabilities instead, which was already partially done, but not for every mode. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: make rate control debugfs stats per stationFelix Fietkau2010-10-154-116/+124
| | | | | | | | | | | | | | | | | | | | | Move them to the same debugfs file that the other rc modules use. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: add missing locking around ath9k_hw_proc_mib_eventFelix Fietkau2010-10-151-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | ath9k_hw_proc_mib_event updates the cycle counters, so it common->cc_lock must be acquired. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k_hw: fix PHY counter overflow handling in ANI v1Felix Fietkau2010-10-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | PHY counter overflows need to be checked for the old ANI version, because of its use of interrupt based counter overflow reports when the counters exceed the configured thresholds. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k_hw: fix division by zero in the ANI monitor codeFelix Fietkau2010-10-151-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit "ath9k_hw: remove code duplication in phy error counter handling" split off some duplicate code into a separate function, but did not have a return code for aborting ANI processing based on counter values. This introduced a divide by zero issue. This patch adds the missing return code check in ath9k_hw_ani_monitor Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: do not track cycle counter updates in powersave modeFelix Fietkau2010-10-151-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While the chip is in powersave mode, the cycle counter updates do not contain useful values. While the chip is in full sleep, the rx_clear signal stays high, indicating a busy medium. To ensure sane values, update cycle counters before going into powersave, and clear them right after switching back to awake. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * iwlwifi: move agn only eeprom functions to separate fileWey-Yi Guy2010-10-145-367/+476
| | | | | | | | | | | | | | | | | | | | | | | | Some of the functions in iwl-eeprom.c file are for agn devices only, Those functions do not have to be part of iwlcore.ko, so move those to iwl-agn-eeprom.c file. Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| | * iwlagn: check beacon frame sizeJohannes Berg2010-10-141-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the beacon_skb is NULL, we might still attempt to use it in this code path (if we ever get here) -- make the code a bit more defensive and check the return value of iwl_fill_beacon_frame() against zero. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| | * iwlwifi: blink LED in IBSS modeJohannes Berg2010-10-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | We recently found that contrary to expectations, the LED is not blinking in IBSS mode. Fix this. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| | * iwlwifi: rewrite RXON checksJohannes Berg2010-10-141-52/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RXON checking is a bit magical, and prints out too much information if something goes wrong. Make it less magical and print out only the items that were actually wrong. Also remove the comment about removing it -- the driver is constantly changing so these checks are useful. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| | * iwlagn: 6050 ops should be used;Wey-Yi Guy2010-10-141-1/+1
| | | | | | | | | | | | | | | | | | | | | For 6050 series of devices, 6050 ops should be used; One of the 6050 config still use 6000 ops, fix it. Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| | * iwlwifi: clean up some beacon handlingJohannes Berg2010-10-141-14/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's no need to check for NULL before calling dev_kfree_skb() since it is valid to call it on NULL -- it becomes a no-op. There's also no need to initialise the beacon_skb variable to NULL just after the memory it is in has been kzalloc'ed. Some minor whitespace cleanups, and a lock assertion in a function that needs the mutex (to access the beacon_skb var) complete the patch. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| | * iwlwifi: rename ibss_beacon variableJohannes Berg2010-10-144-36/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | Since we're also going to support AP (GO) mode, the variable isn't used for just IBSS beacons any more -- rename it to not mislead readers. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| | * iwlwifi: allow probe-after-rx on 2.4 GHzJohannes Berg2010-10-142-28/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two passive 2.4 GHz channels: 12 and 13. If you have a hidden SSID on those, you will not be able to connect to it because we don't send out probe requests there. We can allow this by using the firmware's probe-after-rx functionality on those channels as well. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=16462 Reported-by: Daniel J Blueman <daniel.blueman@gmail.com> Tested-by: Daniel J Blueman <daniel.blueman@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| | * iwlgn: need longer tx queue stuck timer for coex devicesWey-Yi Guy2010-10-142-15/+34
| | | | | | | | | | | | | | | | | | | | | For BT/WiFi combo devices, need longer tx stuck queue timer, so those devices won't reload firmware too often. Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
| | * ath9k: Fix potential use-after-free.Ben Greear2010-10-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The ath_debug_stat_tx references bf->bf_mpdu, which is the skb consumed by ath_tx_complete. So, call the ath_debug_stat_tx method first. Signed-off-by: Ben Greear <greearb@candelatech.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * mac80211: fix SMPS requestJohannes Berg2010-10-131-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like I submitted a different patch than I tested, because clearly the code in mac80211 is missing actually propagating the requested SMPS mode. Fix that! Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: Set RX filter for Probe Request based on filter flagJouni Malinen2010-10-132-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | This allows mac80211 to enable receiving of Probe Request frames in station mode which is needed for P2P. Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * mac80211: add probe request filter flagJohannes Berg2010-10-135-5/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using the frame registration notification, we can see when probe requests are requested and notify the low-level driver via filtering. The flag is also set in AP and IBSS modes. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * cfg80211: notify drivers about frame registrationsJohannes Berg2010-10-132-3/+27
| | | | | | | | | | | | | | | | | | | | | | | | Drivers may need to adjust their filters according to frame registrations, so notify them about them. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: Fix documentation in rate controlMohammed Shafi Shajakhan2010-10-132-8/+9
| | | | | | | | | | | | | | | | | | | | | This fix updates the documenation in Rate Control Table structure Signed-off-by: Mohammed Shafi Shajakhan <mshajakhan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath5k: Move debugfs under ieee80211/[wiphy-name]Ben Greear2010-10-133-36/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This automatically keeps things proper when wiphy is renamed. Based on patch by Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Ben Greear <greearb@candelatech.com> Acked-by: Bruno Randolf <br1@einfach.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * wext: fix alignment problem in serializing 'struct iw_point'Gerrit Renker2010-10-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | wext: fix alignment problem in serializing 'struct iw_point' This fixes a typo in the definition of the serialized length of struct iw_point: a) wireless.h is exported to userspace, the typo causes IW_EV_POINT_PK_LEN to be 12 on 64-bit, and 8 on 32-bit systems (causing misalignment); b) in compat-64 mode iwe_stream_add_point() memcpys overlap (see below). The second case in in compat-64 mode looks like (variable names are as in include/net/iw_handler.h:iwe_stream_add_point()): point_len = IW_EV_COMPAT_POINT_LEN = 8 lcp_len = IW_EV_COMPAT_LCP_LEN = 4 2nd memcpy: IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN = 12 - 4 = 8 IW_EV_LCP_PK_LEN <--------------> *---> 'extra' data area +-------+-------+-------+-------+---------------+------- ...-+ | len | cmd |length | flags | (empty) -> extra ... | +-------+-------+-------+-------+---------------+------- ...-+ 2 2 2 2 4 lcp_len <--------------> <-!! OVERLAP !!> <--1st memcpy--><------- 2nd memcpy -----------> <---- 3rd memcpy ------- ... > <--------- point_len ----------> This case could cause overrun whenever iw_point.length < 4. The other two cases are - * 32-bit systems: IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN = 8 - 4 = 4, the second memcpy copies exactly the 4 required bytes; * 64-bit systems: IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN = 12 - 4 = 8, the second memcpy copies a superfluous (but non overlapping) 4 bytes. The patch changes IW_EV_POINT_PK_LEN to be 8, so that in all 3 cases always only the requested iw_point.{length,flags} (both __u16) are copied, avoiding overrrun (compat-64) and superfluous copy (64-bit). In addition, the userspace header is sanitized (in agreement with version 30 of the wireless tools). Many thanks to Johannes Berg for help and review with this patch. Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-30 15:23:20 +0100