diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-01-12 09:34:50 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-01-13 14:40:56 -0500 |
| commit | 92c1ff1fa772ee76a18ae1edd2e4baecf381f17e (patch) | |
| tree | 1e92c04b64bb3ac4e8d2424e854ef6e9301a8be9 /drivers/net | |
| parent | ccde8a45cbd3ea9a6e785e4393d3a1f6b4e6b495 (diff) | |
| download | linux-92c1ff1fa772ee76a18ae1edd2e4baecf381f17e.tar.gz linux-92c1ff1fa772ee76a18ae1edd2e4baecf381f17e.tar.bz2 linux-92c1ff1fa772ee76a18ae1edd2e4baecf381f17e.zip | |
ipw2x00: signedness bug handling frame length
This is basically just a cleanup. Large positive numbers get counted as
negative but then get implicitly cast to positive again for the checks
that matter.
This does make a small difference in ipw_handle_promiscuous_rx() when we
test "if (unlikely((len + IPW_RX_FRAME_SIZE) > skb_tailroom(rxb->skb)))"
It should return there, but we don't return until a couple lines later
when we test "if (len > IPW_RX_BUF_SIZE - sizeof(struct ipw_rt_hdr)) {".
The difference is that in the second test the sizeof() means that there
is an implied cast to unsigned.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/ipw2x00/ipw2200.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c index 018a8deb88a8..4fcdac63a300 100644 --- a/drivers/net/wireless/ipw2x00/ipw2200.c +++ b/drivers/net/wireless/ipw2x00/ipw2200.c @@ -7848,7 +7848,7 @@ static void ipw_handle_data_packet_monitor(struct ipw_priv *priv, * more efficiently than we can parse it. ORDER MATTERS HERE */ struct ipw_rt_hdr *ipw_rt; - short len = le16_to_cpu(pkt->u.frame.length); + unsigned short len = le16_to_cpu(pkt->u.frame.length); /* We received data from the HW, so stop the watchdog */ dev->trans_start = jiffies; @@ -8023,7 +8023,7 @@ static void ipw_handle_promiscuous_rx(struct ipw_priv *priv, s8 signal = frame->rssi_dbm - IPW_RSSI_TO_DBM; s8 noise = (s8) le16_to_cpu(frame->noise); u8 rate = frame->rate; - short len = le16_to_cpu(pkt->u.frame.length); + unsigned short len = le16_to_cpu(pkt->u.frame.length); struct sk_buff *skb; int hdr_only = 0; u16 filter = priv->prom_priv->filter; |