summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/ath/ath6kl
diff options
context:
space:
mode:
authorVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>2012-09-21 09:15:24 +0200
committerKalle Valo <kvalo@qca.qualcomm.com>2012-10-24 10:49:51 +0200
commitbaec5c6d0b191a44977a5fca131b5215e1868341 (patch)
tree03f9a06ef55be9ea35afdc44509312d50a909ef9 /drivers/net/wireless/ath/ath6kl
parentath6kl: Check for valid endpoint ID values in ath6kl_control_tx() (diff)
downloadlinux-baec5c6d0b191a44977a5fca131b5215e1868341.tar.xz
linux-baec5c6d0b191a44977a5fca131b5215e1868341.zip
ath6kl: Fix random rx data corruption
The skb->tail pointer of rx buffers is not adjusted after skb->data pointer is aligned to 4-byte, this causes random rx data corruption. Signed-off-by: Jin Navy <nhjin@qca.qualcomm.com> Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath6kl')
-rw-r--r--drivers/net/wireless/ath/ath6kl/txrx.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index cf4380d573c4..c4501a9f051c 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -894,8 +894,11 @@ void ath6kl_rx_refill(struct htc_target *target, enum htc_endpoint_id endpoint)
break;
packet = (struct htc_packet *) skb->head;
- if (!IS_ALIGNED((unsigned long) skb->data, 4))
+ if (!IS_ALIGNED((unsigned long) skb->data, 4)) {
+ size_t len = skb_headlen(skb);
skb->data = PTR_ALIGN(skb->data - 4, 4);
+ skb_set_tail_pointer(skb, len);
+ }
set_htc_rxpkt_info(packet, skb, skb->data,
ATH6KL_BUFFER_SIZE, endpoint);
packet->skb = skb;
@@ -917,8 +920,11 @@ void ath6kl_refill_amsdu_rxbufs(struct ath6kl *ar, int count)
return;
packet = (struct htc_packet *) skb->head;
- if (!IS_ALIGNED((unsigned long) skb->data, 4))
+ if (!IS_ALIGNED((unsigned long) skb->data, 4)) {
+ size_t len = skb_headlen(skb);
skb->data = PTR_ALIGN(skb->data - 4, 4);
+ skb_set_tail_pointer(skb, len);
+ }
set_htc_rxpkt_info(packet, skb, skb->data,
ATH6KL_AMSDU_BUFFER_SIZE, 0);
packet->skb = skb;