[PATCH] hostap: Allocate enough tailroom for TKIP

When hostap_tx_encrypt() tries to allocate enough headroom and
tailroom for ieee80211 encryption, it only makes enough room for the
"mpdu" phase of the operation, but forgets about the "msdu" phase.
(For TKIP, these two phases require, respectively, 4 and 8 bytes of
tailroom, per the "ieee80211_crypt_tkip" structure at the bottom of
net/ieee80211/ieee80211_crypt_tkip.c.)

Signed-off-by: Brandon Craig Rhodes <brandon@rhodesmill.org>
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/hostap/hostap_80211_tx.c b/drivers/net/wireless/hostap/hostap_80211_tx.c
index 246fac0e80010bf4537417f0093b6a8d682bffdd..3df3c60263d4ac07e50e4aa4029a0f03affdc101 100644 (file)
--- a/drivers/net/wireless/hostap/hostap_80211_tx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_tx.c
@@ -311,7 +311,7 @@ static struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
        local_info_t *local;
        struct ieee80211_hdr_4addr *hdr;
        u16 fc;
-       int hdr_len, res;
+       int prefix_len, postfix_len, hdr_len, res;
 
        iface = netdev_priv(skb->dev);
        local = iface->local;
@@ -337,10 +337,13 @@ static struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
        if (skb == NULL)
                return NULL;
 
-       if ((skb_headroom(skb) < crypt->ops->extra_mpdu_prefix_len ||
-            skb_tailroom(skb) < crypt->ops->extra_mpdu_postfix_len) &&
-           pskb_expand_head(skb, crypt->ops->extra_mpdu_prefix_len,
-                            crypt->ops->extra_mpdu_postfix_len, GFP_ATOMIC)) {
+       prefix_len = crypt->ops->extra_mpdu_prefix_len +
+               crypt->ops->extra_msdu_prefix_len;
+       postfix_len = crypt->ops->extra_mpdu_postfix_len +
+               crypt->ops->extra_msdu_postfix_len;
+       if ((skb_headroom(skb) < prefix_len ||
+            skb_tailroom(skb) < postfix_len) &&
+           pskb_expand_head(skb, prefix_len, postfix_len, GFP_ATOMIC)) {
                kfree_skb(skb);
                return NULL;
        }