diff options
| author | Sascha Hauer <s.hauer@pengutronix.de> | 2011-08-08 08:22:41 +0200 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2011-08-08 08:22:41 +0200 |
| commit | 1a43f2012455a977397deffe35912fd3f3ce17b9 (patch) | |
| tree | 5189f337df44e7a495fbd097cd476b0380babd8c /drivers/net/wireless/rt2x00/rt2x00dev.c | |
| parent | e1b96ada659431669efaf3defa997abf5db68130 (diff) | |
| parent | 322a8b034003c0d46d39af85bf24fee27b902f48 (diff) | |
Merge commit 'v3.1-rc1' into imx-fixes
Diffstat (limited to 'drivers/net/wireless/rt2x00/rt2x00dev.c')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt2x00dev.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c index 939821b4af2f..0955c941317f 100644 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c @@ -583,6 +583,18 @@ void rt2x00lib_rxdone(struct queue_entry *entry) rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc); /* + * Check for valid size in case we get corrupted descriptor from + * hardware. + */ + if (unlikely(rxdesc.size == 0 || + rxdesc.size > entry->queue->data_size)) { + WARNING(rt2x00dev, "Wrong frame size %d max %d.\n", + rxdesc.size, entry->queue->data_size); + dev_kfree_skb(entry->skb); + goto renew_skb; + } + + /* * The data behind the ieee80211 header must be * aligned on a 4 byte boundary. */ @@ -642,6 +654,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry) ieee80211_rx_ni(rt2x00dev->hw, entry->skb); +renew_skb: /* * Replace the skb with the freshly allocated one. */ |