iwlagn: use huge command for beacon

When testing some new P2P code, Angie found that the
driver might crash because the beacon command ended
up being bigger than a regular command. This is quite
obvious -- a normal command is limited to roughly 360
bytes but a beacon may be much larger of course.

To fix this, use the huge command buffer.

Reported-by: Angie Chinchilla <angie.v.chinchilla@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 0daededb0ff228d2d871723b335efc9b213e9701..3cfd7ebb34489f61e51e9fe9d363c137e2517edf 100644 (file)
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -253,6 +253,10 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
        struct iwl_frame *frame;
        unsigned int frame_size;
        int rc;
+       struct iwl_host_cmd cmd = {
+               .id = REPLY_TX_BEACON,
+               .flags = CMD_SIZE_HUGE,
+       };
 
        frame = iwl_get_free_frame(priv);
        if (!frame) {
@@ -268,8 +272,10 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
                return -EINVAL;
        }
 
-       rc = iwl_send_cmd_pdu(priv, REPLY_TX_BEACON, frame_size,
-                             &frame->u.cmd[0]);
+       cmd.len = frame_size;
+       cmd.data = &frame->u.cmd[0];
+
+       rc = iwl_send_cmd_sync(priv, &cmd);
 
        iwl_free_frame(priv, frame);