Skip to content
Commit a6756da9 authored by Jason Conti's avatar Jason Conti Committed by John W. Linville
Browse files

p54: Initialize extra_len in p54_tx_80211



This patch fixes a very serious off-by-one bug in
the driver, which could leave the device in an
unresponsive state.

The problem was that the extra_len variable [used to
reserve extra scratch buffer space for the firmware]
was left uninitialized. Because p54_assign_address
later needs the value to reserve additional space,
the resulting frame could be to big for the small
device's memory window and everything would
immediately come to a grinding halt.

Reference: https://bugs.launchpad.net/bugs/722185

Cc: <stable@kernel.org>
Acked-by: default avatarChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: default avatarJason Conti <jason.conti@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 96f372c9
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment