rpms/kernel/F-8 kernel.spec, 1.232, 1.233 linux-2.6-wireless-fixes.patch, 1.1, 1.2

[John W. Linville (linville)]

Author: linville

Update of /cvs/pkgs/rpms/kernel/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv27097

Modified Files:
	kernel.spec linux-2.6-wireless-fixes.patch 
Log Message:
avoid null ptr dereference in rx path of zd1201 driver


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-8/kernel.spec,v
retrieving revision 1.232
retrieving revision 1.233
diff -u -r1.232 -r1.233
--- kernel.spec	17 Oct 2007 20:47:16 -0000	1.232
+++ kernel.spec	18 Oct 2007 14:48:27 -0000	1.233
@@ -1855,6 +1855,9 @@
 
 
 %changelog
+* Thu Oct 18 2007 John W. Linville <linville at redhat.com>
+- avoid null ptr dereference in rx path of zd1201 driver
+
 * Wed Oct 17 2007 John W. Linville <linville at redhat.com>
 - iee80211: fix an endian bug
 - mac80211: change BSSID list key to (BSSID, SSID, frequency) tuple

linux-2.6-wireless-fixes.patch:

Index: linux-2.6-wireless-fixes.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-8/linux-2.6-wireless-fixes.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- linux-2.6-wireless-fixes.patch	17 Oct 2007 20:47:16 -0000	1.1
+++ linux-2.6-wireless-fixes.patch	18 Oct 2007 14:48:27 -0000	1.2
@@ -1,6 +1,6 @@
 diff -up linux-2.6.23.noarch/net/ieee80211/ieee80211_crypt_tkip.c.orig linux-2.6.23.noarch/net/ieee80211/ieee80211_crypt_tkip.c
---- linux-2.6.23.noarch/net/ieee80211/ieee80211_crypt_tkip.c.orig	2007-10-17 16:08:00.000000000 -0400
-+++ linux-2.6.23.noarch/net/ieee80211/ieee80211_crypt_tkip.c	2007-10-17 16:08:05.000000000 -0400
+--- linux-2.6.23.noarch/net/ieee80211/ieee80211_crypt_tkip.c.orig	2007-10-18 10:46:34.000000000 -0400
++++ linux-2.6.23.noarch/net/ieee80211/ieee80211_crypt_tkip.c	2007-10-18 10:46:41.000000000 -0400
 @@ -584,7 +584,7 @@ static void michael_mic_hdr(struct sk_bu
  	if (stype & IEEE80211_STYPE_QOS_DATA) {
  		const struct ieee80211_hdr_3addrqos *qoshdr =
@@ -11,8 +11,8 @@
  		hdr[12] = 0;		/* priority */
  
 diff -up linux-2.6.23.noarch/net/mac80211/ieee80211_ioctl.c.orig linux-2.6.23.noarch/net/mac80211/ieee80211_ioctl.c
---- linux-2.6.23.noarch/net/mac80211/ieee80211_ioctl.c.orig	2007-10-17 16:08:00.000000000 -0400
-+++ linux-2.6.23.noarch/net/mac80211/ieee80211_ioctl.c	2007-10-17 16:08:05.000000000 -0400
+--- linux-2.6.23.noarch/net/mac80211/ieee80211_ioctl.c.orig	2007-10-18 10:46:34.000000000 -0400
++++ linux-2.6.23.noarch/net/mac80211/ieee80211_ioctl.c	2007-10-18 10:46:41.000000000 -0400
 @@ -1320,10 +1320,11 @@ static int ieee80211_ioctl_giwap(struct 
  
  static int ieee80211_ioctl_siwscan(struct net_device *dev,
@@ -42,8 +42,8 @@
  }
  
 diff -up linux-2.6.23.noarch/net/mac80211/ieee80211_sta.c.orig linux-2.6.23.noarch/net/mac80211/ieee80211_sta.c
---- linux-2.6.23.noarch/net/mac80211/ieee80211_sta.c.orig	2007-10-17 16:08:00.000000000 -0400
-+++ linux-2.6.23.noarch/net/mac80211/ieee80211_sta.c	2007-10-17 16:12:31.000000000 -0400
+--- linux-2.6.23.noarch/net/mac80211/ieee80211_sta.c.orig	2007-10-18 10:46:34.000000000 -0400
++++ linux-2.6.23.noarch/net/mac80211/ieee80211_sta.c	2007-10-18 10:46:41.000000000 -0400
 @@ -12,7 +12,6 @@
   */
  
@@ -438,3 +438,26 @@
  		printk(KERN_DEBUG "%s: Selected IBSS BSSID " MAC_FMT
  		       " based on configured SSID\n",
  		       dev->name, MAC_ARG(bssid));
+diff -up linux-2.6.23.noarch/drivers/net/wireless/zd1201.c.orig linux-2.6.23.noarch/drivers/net/wireless/zd1201.c
+--- linux-2.6.23.noarch/drivers/net/wireless/zd1201.c.orig	2007-10-09 16:31:38.000000000 -0400
++++ linux-2.6.23.noarch/drivers/net/wireless/zd1201.c	2007-10-18 10:46:55.000000000 -0400
+@@ -327,8 +327,8 @@ static void zd1201_usbrx(struct urb *urb
+ 			memcpy(skb_put(skb, 6), &data[datalen-8], 6);
+ 			memcpy(skb_put(skb, 2), &data[datalen-24], 2);
+ 			memcpy(skb_put(skb, len), data, len);
+-			skb->dev->last_rx = jiffies;
+ 			skb->protocol = eth_type_trans(skb, zd->dev);
++			skb->dev->last_rx = jiffies;
+ 			zd->stats.rx_packets++;
+ 			zd->stats.rx_bytes += skb->len;
+ 			netif_rx(skb);
+@@ -384,8 +384,8 @@ static void zd1201_usbrx(struct urb *urb
+ 			memcpy(skb_put(skb, 2), &data[6], 2);
+ 			memcpy(skb_put(skb, len), data+8, len);
+ 		}
+-		skb->dev->last_rx = jiffies;
+ 		skb->protocol = eth_type_trans(skb, zd->dev);
++		skb->dev->last_rx = jiffies;
+ 		zd->stats.rx_packets++;
+ 		zd->stats.rx_bytes += skb->len;
+ 		netif_rx(skb);