xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libertas: fix pointer bugs for PS_MODE commands

Browse Source 
struct cmd_ds_802_11_ps_mode
contains the command header and a pointer to it was
initialized with data points to the body which leads to
mis-interpretation of the cmd_ds_802_11_ps_mode.action member.
cmd[0] contains the header, &cmd[1] points beyond that.
cmdnode->cmdbuf is a pointer to the command buffer
This piece of code was unused since power saving was
not enabled.

Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This commit is contained in:
Andreas Kemnade
2016-01-30 18:01:51 +01:00
committed by Kalle Valo
parent efdf0e393e
commit 0a7701b4de
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/marvell/libertas/cmdresp.c
View File

@@ -123,7 +123,10 @@ int lbs_process_command_response(struct lbs_private *priv, u8 *data, u32 len)
priv->cmd_timed_out = 0;
if (respcmd == CMD_RET(CMD_802_11_PS_MODE)) {
struct cmd_ds_802_11_ps_mode *psmode = (void *) &resp[1];
/* struct cmd_ds_802_11_ps_mode also contains
* the header
*/
struct cmd_ds_802_11_ps_mode *psmode = (void *)resp;
u16 action = le16_to_cpu(psmode->action);
lbs_deb_host(