Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-15 09:55:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

airo: sanitize APListRid handling

Browse Source 
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Al Viro 2007-12-20 17:49:41 -05:00 committed by David S. Miller
parent 56d81bd3c7
commit a749716ecc
1 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/net/wireless/airo.c
View File

@ -713,7 +713,7 @@ typedef struct {
typedef struct { typedef struct {
u16 len; __le16 len;
u8 ap[4][ETH_ALEN]; u8 ap[4][ETH_ALEN];
} APListRid; } APListRid;
@ -1866,16 +1866,15 @@ static int readStatusRid(struct airo_info*ai, StatusRid *statr, int lock) {
statr->assocStatus = le16_to_cpu(statr->assocStatus); statr->assocStatus = le16_to_cpu(statr->assocStatus);
return rc; return rc;
} }
static int readAPListRid(struct airo_info*ai, APListRid *aplr) {
int rc = PC4500_readrid(ai, RID_APLIST, aplr, sizeof(*aplr), 1); static int readAPListRid(struct airo_info *ai, APListRid *aplr)
aplr->len = le16_to_cpu(aplr->len); {
return rc; return PC4500_readrid(ai, RID_APLIST, aplr, sizeof(*aplr), 1);
} }
static int writeAPListRid(struct airo_info*ai, APListRid *aplr, int lock) {
int rc; static int writeAPListRid(struct airo_info *ai, APListRid *aplr, int lock)
aplr->len = cpu_to_le16(aplr->len); {
rc = PC4500_writerid(ai, RID_APLIST, aplr, sizeof(*aplr), lock); return PC4500_writerid(ai, RID_APLIST, aplr, sizeof(*aplr), lock);
return rc;
} }
static int readCapabilityRid(struct airo_info *ai, CapabilityRid *capr, int lock) static int readCapabilityRid(struct airo_info *ai, CapabilityRid *capr, int lock)
@ -5145,7 +5144,7 @@ static void proc_APList_on_close( struct inode *inode, struct file *file ) {
if ( !data->writelen ) return; if ( !data->writelen ) return;
memset( &APList_rid, 0, sizeof(APList_rid) ); memset( &APList_rid, 0, sizeof(APList_rid) );
APList_rid.len = sizeof(APList_rid); APList_rid.len = cpu_to_le16(sizeof(APList_rid));
for( i = 0; i < 4 && data->writelen >= (i+1)*6*3; i++ ) { for( i = 0; i < 4 && data->writelen >= (i+1)*6*3; i++ ) {
int j; int j;
@ -5943,7 +5942,7 @@ static int airo_set_wap(struct net_device *dev,
up(&local->sem); up(&local->sem);
} else { } else {
memset(&APList_rid, 0, sizeof(APList_rid)); memset(&APList_rid, 0, sizeof(APList_rid));
APList_rid.len = sizeof(APList_rid); APList_rid.len = cpu_to_le16(sizeof(APList_rid));
memcpy(APList_rid.ap[0], awrq->sa_data, ETH_ALEN); memcpy(APList_rid.ap[0], awrq->sa_data, ETH_ALEN);
disable_MAC(local, 1); disable_MAC(local, 1);
writeAPListRid(local, &APList_rid, 1); writeAPListRid(local, &APList_rid, 1);