summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/mediatek/mt7601u/mac.c
diff options
context:
space:
mode:
authorJakub Kicinski <kubakici@wp.pl>2015-06-02 21:11:26 +0200
committerKalle Valo <kvalo@codeaurora.org>2015-06-08 13:28:07 +0200
commit2af6d21fce9990630d2adfda5a329706aa9e3571 (patch)
treebabecf7391ea6c31aba4584b34fc5fb994d0200e /drivers/net/wireless/mediatek/mt7601u/mac.c
parentmt7601u: unify paged and non-paged RX dma paths (diff)
downloadlinux-2af6d21fce9990630d2adfda5a329706aa9e3571.tar.xz
linux-2af6d21fce9990630d2adfda5a329706aa9e3571.zip
mt7601u: watch out for invalid-length frames
Users of older Ralink devices report that received frames sometimes have zero length. Watch out for that. Signed-off-by: Jakub Kicinski <kubakici@wp.pl> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/mediatek/mt7601u/mac.c')
-rw-r--r--drivers/net/wireless/mediatek/mt7601u/mac.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/net/wireless/mediatek/mt7601u/mac.c b/drivers/net/wireless/mediatek/mt7601u/mac.c
index c161bcc6a7fa..7514bce1ac91 100644
--- a/drivers/net/wireless/mediatek/mt7601u/mac.c
+++ b/drivers/net/wireless/mediatek/mt7601u/mac.c
@@ -450,10 +450,14 @@ u32 mt76_mac_process_rx(struct mt7601u_dev *dev, struct sk_buff *skb,
{
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
struct mt7601u_rxwi *rxwi = rxi;
- u32 ctl = le32_to_cpu(rxwi->ctl);
+ u32 len, ctl = le32_to_cpu(rxwi->ctl);
u16 rate = le16_to_cpu(rxwi->rate);
int rssi;
+ len = MT76_GET(MT_RXWI_CTL_MPDU_LEN, ctl);
+ if (len < 10)
+ return 0;
+
if (rxwi->rxinfo & cpu_to_le32(MT_RXINFO_DECRYPT)) {
status->flag |= RX_FLAG_DECRYPTED;
status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED;
@@ -474,7 +478,7 @@ u32 mt76_mac_process_rx(struct mt7601u_dev *dev, struct sk_buff *skb,
dev->avg_rssi = (dev->avg_rssi * 15) / 16 + (rssi << 8);
spin_unlock_bh(&dev->con_mon_lock);
- return MT76_GET(MT_RXWI_CTL_MPDU_LEN, ctl);
+ return len;
}
static enum mt76_cipher_type