GIT b8b766912d4bd7d9d02580dabde833b75396db41 git+ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6.git#upstream commit Author: John W. Linville Date: Tue Nov 14 20:08:53 2006 -0500 [PATCH] prism54: correct overly aggressive check of return from pci_set_mwi Failure of pci_set_mwi should not be considered a fatal error. Signed-off-by: John W. Linville commit a1862119097c23fc36de5adce87386fd37b205e2 Author: Larry Finger Date: Wed Nov 8 11:04:49 2006 -0600 [PATCH] bcm43xx: correct "Move IV/ICV stripping into ieee80211_rx" In the patch sent by Daniel Drake under the title "[PATCH] ieee80211: Move IV/ICV stripping into ieee80211_rx", a needed line was accidentally removed. (NOTE: I'm pretty sure this was my fault, not Daniel's. -- JWL) Signed-off-by: Larry Finger Signed-off-by: John W. Linville commit efa53ebe0d2f50bf342eb1976824f59bba9941eb Author: Zhu Yi Date: Mon Nov 13 11:32:50 2006 +0800 [PATCH] ieee80211: Fix kernel panic when QoS is enabled The 802.11 header length is affected by the wireless mode (WDS or not) and type (QoS or not). We should use the variable hdr_len instead of the hard coded IEEE80211_3ADDR_LEN, otherwise we may touch invalid memory. Signed-off-by: Zhu Yi Signed-off-by: John W. Linville drivers/net/wireless/bcm43xx/bcm43xx_xmit.c | 1 + drivers/net/wireless/prism54/islpci_hotplug.c | 4 ++-- net/ieee80211/ieee80211_tx.c | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c b/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c index a957bc8..3e24626 100644 --- a/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c +++ b/drivers/net/wireless/bcm43xx/bcm43xx_xmit.c @@ -543,6 +543,7 @@ int bcm43xx_rx(struct bcm43xx_private *b break; } + frame_ctl = le16_to_cpu(wlhdr->frame_ctl); switch (WLAN_FC_GET_TYPE(frame_ctl)) { case IEEE80211_FTYPE_MGMT: ieee80211_rx_mgt(bcm->ieee, wlhdr, &stats); diff --git a/drivers/net/wireless/prism54/islpci_hotplug.c b/drivers/net/wireless/prism54/islpci_hotplug.c index e0bca3a..58257b4 100644 --- a/drivers/net/wireless/prism54/islpci_hotplug.c +++ b/drivers/net/wireless/prism54/islpci_hotplug.c @@ -170,8 +170,8 @@ #endif pci_set_master(pdev); /* enable MWI */ - if (pci_set_mwi(pdev)) - goto do_pci_release_regions; + if (!pci_set_mwi(pdev)) + printk(KERN_INFO "%s: pci_set_mwi(pdev) succeeded\n", DRV_NAME); /* setup the network device interface and its structure */ if (!(ndev = islpci_setup(pdev))) { diff --git a/net/ieee80211/ieee80211_tx.c b/net/ieee80211/ieee80211_tx.c index ae25449..854fc13 100644 --- a/net/ieee80211/ieee80211_tx.c +++ b/net/ieee80211/ieee80211_tx.c @@ -390,7 +390,7 @@ int ieee80211_xmit(struct sk_buff *skb, * this stack is providing the full 802.11 header, one will * eventually be affixed to this fragment -- so we must account * for it when determining the amount of payload space. */ - bytes_per_frag = frag_size - IEEE80211_3ADDR_LEN; + bytes_per_frag = frag_size - hdr_len; if (ieee->config & (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS)) bytes_per_frag -= IEEE80211_FCS_LEN; @@ -412,7 +412,7 @@ int ieee80211_xmit(struct sk_buff *skb, } else { nr_frags = 1; bytes_per_frag = bytes_last_frag = bytes; - frag_size = bytes + IEEE80211_3ADDR_LEN; + frag_size = bytes + hdr_len; } rts_required = (frag_size > ieee->rts