Skip to content

Commit

Permalink
rndis_wlan: fix broken data copy
Browse files Browse the repository at this point in the history
Replace broken code that attempted to copy 6 byte array to 64-bit
integer. Due to missing cast to 64-bit integer, left shift operation
were 32-bit and lead to bytes been copied over each other. New code
uses simple memcpy, for greater readability and efficiency.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Jussi Kivilinna authored and John W. Linville committed Mar 4, 2008
1 parent 8a96df8 commit cdb2a9f
Showing 1 changed file with 3 additions and 5 deletions.
8 changes: 3 additions & 5 deletions drivers/net/wireless/rndis_wlan.c
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,7 @@ struct NDIS_802_11_KEY {
__le32 KeyLength;
u8 Bssid[6];
u8 Padding[6];
__le64 KeyRSC;
u8 KeyRSC[8];
u8 KeyMaterial[32];
} __attribute__((packed));

Expand Down Expand Up @@ -1508,7 +1508,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
struct usbnet *usbdev = dev->priv;
struct rndis_wext_private *priv = get_rndis_wext_priv(usbdev);
struct NDIS_802_11_KEY ndis_key;
int i, keyidx, ret;
int keyidx, ret;
u8 *addr;

keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX;
Expand Down Expand Up @@ -1543,9 +1543,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
ndis_key.KeyIndex = cpu_to_le32(keyidx);

if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
for (i = 0; i < 6; i++)
ndis_key.KeyRSC |=
cpu_to_le64(ext->rx_seq[i] << (i * 8));
memcpy(ndis_key.KeyRSC, ext->rx_seq, 6);
ndis_key.KeyIndex |= cpu_to_le32(1 << 29);
}

Expand Down

0 comments on commit cdb2a9f

Please sign in to comment.