libertas: fix buffer overrun

[safe/jmp/linux-2.6] / drivers / net / wireless / libertas / hostcmd.h

diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index b8e3720..d9f9a12 100644 (file)
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -151,10 +151,6 @@ struct cmd_ds_get_hw_spec {
        __le32 fwcapinfo;
 } __attribute__ ((packed));
 
-struct cmd_ds_802_11_reset {
-       __le16 action;
-};
-
 struct cmd_ds_802_11_subscribe_event {
        struct cmd_header hdr;
 
@@ -219,6 +215,7 @@ struct cmd_ds_mac_control {
 };
 
 struct cmd_ds_mac_multicast_adr {
+       struct cmd_header hdr;
        __le16 action;
        __le16 nr_of_adrs;
        u8 maclist[ETH_ALEN * MRVDRV_MAX_MULTICAST_LIST_SIZE];
@@ -231,7 +228,9 @@ struct cmd_ds_802_11_authenticate {
 };
 
 struct cmd_ds_802_11_deauthenticate {
-       u8 macaddr[6];
+       struct cmd_header hdr;
+
+       u8 macaddr[ETH_ALEN];
        __le16 reasoncode;
 };
 
@@ -250,20 +249,10 @@ struct cmd_ds_802_11_associate {
 #endif
 } __attribute__ ((packed));
 
-struct cmd_ds_802_11_disassociate {
-       u8 destmacaddr[6];
-       __le16 reasoncode;
-};
-
 struct cmd_ds_802_11_associate_rsp {
        struct ieeetypes_assocrsp assocRsp;
 };
 
-struct cmd_ds_802_11_ad_hoc_result {
-       u8 pad[3];
-       u8 bssid[ETH_ALEN];
-};
-
 struct cmd_ds_802_11_set_wep {
        struct cmd_header hdr;
 
@@ -308,7 +297,9 @@ struct cmd_ds_802_11_get_stat {
 };
 
 struct cmd_ds_802_11_snmp_mib {
-       __le16 querytype;
+       struct cmd_header hdr;
+
+       __le16 action;
        __le16 oid;
        __le16 bufsize;
        u8 value[128];
@@ -427,13 +418,19 @@ struct cmd_ds_802_11_rssi_rsp {
 };
 
 struct cmd_ds_802_11_mac_address {
+       struct cmd_header hdr;
+
        __le16 action;
        u8 macadd[ETH_ALEN];
 };
 
 struct cmd_ds_802_11_rf_tx_power {
+       struct cmd_header hdr;
+
        __le16 action;
-       __le16 currentlevel;
+       __le16 curlevel;
+       s8 maxlevel;
+       s8 minlevel;
 };
 
 struct cmd_ds_802_11_rf_antenna {
@@ -478,14 +475,11 @@ struct cmd_ds_802_11_ps_mode {
        __le16 locallisteninterval;
 };
 
-struct PS_CMD_ConfirmSleep {
-       __le16 command;
-       __le16 size;
-       __le16 seqnum;
-       __le16 result;
+struct cmd_confirm_sleep {
+       struct cmd_header hdr;
 
        __le16 action;
-       __le16 reserved1;
+       __le16 nullpktinterval;
        __le16 multipledtim;
        __le16 reserved;
        __le16 locallisteninterval;
@@ -500,16 +494,19 @@ struct cmd_ds_802_11_data_rate {
 };
 
 struct cmd_ds_802_11_rate_adapt_rateset {
+       struct cmd_header hdr;
        __le16 action;
        __le16 enablehwauto;
        __le16 bitmap;
 };
 
 struct cmd_ds_802_11_ad_hoc_start {
+       struct cmd_header hdr;
+
        u8 ssid[IW_ESSID_MAX_SIZE];
        u8 bsstype;
        __le16 beaconperiod;
-       u8 dtimperiod;
+       u8 dtimperiod;   /* Reserved on v9 and later */
        union IEEEtypes_ssparamset ssparamset;
        union ieeetypes_phyparamset phyparamset;
        __le16 probedelay;
@@ -518,9 +515,16 @@ struct cmd_ds_802_11_ad_hoc_start {
        u8 tlv_memory_size_pad[100];
 } __attribute__ ((packed));
 
+struct cmd_ds_802_11_ad_hoc_result {
+       struct cmd_header hdr;
+
+       u8 pad[3];
+       u8 bssid[ETH_ALEN];
+};
+
 struct adhoc_bssdesc {
-       u8 bssid[6];
-       u8 ssid[32];
+       u8 bssid[ETH_ALEN];
+       u8 ssid[IW_ESSID_MAX_SIZE];
        u8 type;
        __le16 beaconperiod;
        u8 dtimperiod;
@@ -538,10 +542,15 @@ struct adhoc_bssdesc {
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11_ad_hoc_join {
+       struct cmd_header hdr;
+
        struct adhoc_bssdesc bss;
-       __le16 failtimeout;
-       __le16 probedelay;
+       __le16 failtimeout;   /* Reserved on v9 and later */
+       __le16 probedelay;    /* Reserved on v9 and later */
+} __attribute__ ((packed));
 
+struct cmd_ds_802_11_ad_hoc_stop {
+       struct cmd_header hdr;
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11_enable_rsn {
@@ -586,23 +595,38 @@ struct cmd_ds_802_11_key_material {
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11_eeprom_access {
+       struct cmd_header hdr;
        __le16 action;
-
-       /* multiple 4 */
        __le16 offset;
-       __le16 bytecount;
-       u8 value;
+       __le16 len;
+       /* firmware says it returns a maximum of 20 bytes */
+#define LBS_EEPROM_READ_LEN 20
+       u8 value[LBS_EEPROM_READ_LEN];
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11_tpc_cfg {
+       struct cmd_header hdr;
+
        __le16 action;
-       u8 enable;
-       s8 P0;
-       s8 P1;
-       s8 P2;
-       u8 usesnr;
+       uint8_t enable;
+       int8_t P0;
+       int8_t P1;
+       int8_t P2;
+       uint8_t usesnr;
 } __attribute__ ((packed));
 
+
+struct cmd_ds_802_11_pa_cfg {
+       struct cmd_header hdr;
+
+       __le16 action;
+       uint8_t enable;
+       int8_t P0;
+       int8_t P1;
+       int8_t P2;
+} __attribute__ ((packed));
+
+
 struct cmd_ds_802_11_led_ctrl {
        __le16 action;
        __le16 numled;
@@ -691,28 +715,16 @@ struct cmd_ds_command {
        union {
                struct cmd_ds_802_11_ps_mode psmode;
                struct cmd_ds_802_11_associate associate;
-               struct cmd_ds_802_11_deauthenticate deauth;
-               struct cmd_ds_802_11_ad_hoc_start ads;
-               struct cmd_ds_802_11_reset reset;
-               struct cmd_ds_802_11_ad_hoc_result result;
                struct cmd_ds_802_11_authenticate auth;
                struct cmd_ds_802_11_get_stat gstat;
                struct cmd_ds_802_3_get_stat gstat_8023;
-               struct cmd_ds_802_11_snmp_mib smib;
-               struct cmd_ds_802_11_rf_tx_power txp;
                struct cmd_ds_802_11_rf_antenna rant;
                struct cmd_ds_802_11_monitor_mode monitor;
-               struct cmd_ds_802_11_rate_adapt_rateset rateset;
-               struct cmd_ds_mac_multicast_adr madr;
-               struct cmd_ds_802_11_ad_hoc_join adj;
                struct cmd_ds_802_11_rssi rssi;
                struct cmd_ds_802_11_rssi_rsp rssirsp;
-               struct cmd_ds_802_11_disassociate dassociate;
-               struct cmd_ds_802_11_mac_address macadd;
                struct cmd_ds_mac_reg_access macreg;
                struct cmd_ds_bbp_reg_access bbpreg;
                struct cmd_ds_rf_reg_access rfreg;
-               struct cmd_ds_802_11_eeprom_access rdeeprom;
 
                struct cmd_ds_802_11d_domain_info domaininfo;
                struct cmd_ds_802_11d_domain_info domaininforesp;