iwmc3200wifi: fix array out-of-boundary access

[pandora-kernel.git] / drivers / net / wireless / iwmc3200wifi / iwm.h

diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 1b02a4e..8428111 100644 (file)
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -65,6 +65,8 @@ struct iwm_conf {
        u32 sdio_ior_timeout;
        unsigned long calib_map;
        unsigned long expected_calib_map;
+       u8 ct_kill_entry;
+       u8 ct_kill_exit;
        bool reset_on_fatal_err;
        bool auto_connect;
        bool wimax_not_present;
@@ -79,7 +81,6 @@ struct iwm_conf {
        u32 assoc_timeout;
        u32 roam_timeout;
        u32 wireless_mode;
-       u32 coexist_mode;
 
        u8 ibss_band;
        u8 ibss_channel;
@@ -129,11 +130,18 @@ struct iwm_notif {
        unsigned long buf_size;
 };
 
+struct iwm_tid_info {
+       __le16 last_seq_num;
+       bool stopped;
+       struct mutex mutex;
+};
+
 struct iwm_sta_info {
        u8 addr[ETH_ALEN];
        bool valid;
        bool qos;
        u8 color;
+       struct iwm_tid_info tid_info[IWM_UMAC_TID_NR];
 };
 
 struct iwm_tx_info {
@@ -183,6 +191,8 @@ struct iwm_key {
 struct iwm_tx_queue {
        int id;
        struct sk_buff_head queue;
+       struct sk_buff_head stopped_queue;
+       spinlock_t lock;
        struct workqueue_struct *wq;
        struct work_struct worker;
        u8 concat_buf[IWM_HAL_CONCATENATE_BUF_SIZE];
@@ -258,7 +268,7 @@ struct iwm_priv {
 
        struct sk_buff_head rx_list;
        struct list_head rx_tickets;
-       struct list_head rx_packets[IWM_RX_ID_HASH];
+       struct list_head rx_packets[IWM_RX_ID_HASH + 1];
        struct workqueue_struct *rx_wq;
        struct work_struct rx_worker;
 
@@ -276,12 +286,14 @@ struct iwm_priv {
        struct iw_statistics wstats;
        struct delayed_work stats_request;
        struct delayed_work disconnect;
+       struct delayed_work ct_kill_delay;
 
        struct iwm_debugfs dbg;
 
        u8 *eeprom;
        struct timer_list watchdog;
        struct work_struct reset_worker;
+       struct work_struct auth_retry_worker;
        struct mutex mutex;
 
        u8 *req_ie;
@@ -290,6 +302,8 @@ struct iwm_priv {
        int resp_ie_len;
 
        struct iwm_fw_error_hdr *last_fw_err;
+       char umac_version[8];
+       char lmac_version[8];
 
        char private[0] __attribute__((__aligned__(NETDEV_ALIGN)));
 };
@@ -335,6 +349,7 @@ int iwm_up(struct iwm_priv *iwm);
 int iwm_down(struct iwm_priv *iwm);
 
 /* TX API */
+int iwm_tid_to_queue(u16 tid);
 void iwm_tx_credit_inc(struct iwm_priv *iwm, int id, int total_freed_pages);
 void iwm_tx_worker(struct work_struct *work);
 int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev);