rt2x00: don't write past the end when writing short descriptors on rt61

[safe/jmp/linux-2.6] / drivers / net / wireless / rt2x00 / rt61pci.c

diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 547fa33..5e08541 100644 (file)
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1531,9 +1531,11 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
        rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
        rt2x00_desc_write(txd, 5, word);
 
-       rt2x00_desc_read(txd, 11, &word);
-       rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skbdesc->data_len);
-       rt2x00_desc_write(txd, 11, word);
+       if (skbdesc->desc_len > TXINFO_SIZE) {
+               rt2x00_desc_read(txd, 11, &word);
+               rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skbdesc->data_len);
+               rt2x00_desc_write(txd, 11, word);
+       }
 
        rt2x00_desc_read(txd, 0, &word);
        rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);