diff options
| author | John W. Linville <linville@tuxdriver.com> | 2011-06-24 21:25:51 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-06-24 21:25:51 +0200 |
| commit | 36099365c7cc64e5184b66b6eb094950a13f540c (patch) | |
| tree | c91b9f3719f94864a62f2d15a71aaecd54c56711 /drivers/net/wireless/rt2x00/rt2x00dev.c | |
| parent | qlcnic: multi protocol internal loopback support added. (diff) | |
| parent | Bluetooth: include scatterlist.h where needed (diff) | |
| download | linux-36099365c7cc64e5184b66b6eb094950a13f540c.tar.xz linux-36099365c7cc64e5184b66b6eb094950a13f540c.zip | |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem
Conflicts:
drivers/net/wireless/rtlwifi/pci.c
include/linux/netlink.h
Diffstat (limited to 'drivers/net/wireless/rt2x00/rt2x00dev.c')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt2x00dev.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c index 939821b4af2f..0955c941317f 100644 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c @@ -583,6 +583,18 @@ void rt2x00lib_rxdone(struct queue_entry *entry) rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc); /* + * Check for valid size in case we get corrupted descriptor from + * hardware. + */ + if (unlikely(rxdesc.size == 0 || + rxdesc.size > entry->queue->data_size)) { + WARNING(rt2x00dev, "Wrong frame size %d max %d.\n", + rxdesc.size, entry->queue->data_size); + dev_kfree_skb(entry->skb); + goto renew_skb; + } + + /* * The data behind the ieee80211 header must be * aligned on a 4 byte boundary. */ @@ -642,6 +654,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry) ieee80211_rx_ni(rt2x00dev->hw, entry->skb); +renew_skb: /* * Replace the skb with the freshly allocated one. */ |