Commit b7b1b512 authored by Vasanthakumar Thiagarajan's avatar Vasanthakumar Thiagarajan Committed by John W. Linville

ath9k: Fix bug in validating received data length for edma

The rx status length should also be taken into account while
validating the length of a received frame.
Signed-off-by: default avatarVasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 5c6dd921
...@@ -830,6 +830,7 @@ static bool ath9k_rx_accept(struct ath_common *common, ...@@ -830,6 +830,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
{ {
struct ath_hw *ah = common->ah; struct ath_hw *ah = common->ah;
__le16 fc; __le16 fc;
u8 rx_status_len = ah->caps.rx_status_len;
fc = hdr->frame_control; fc = hdr->frame_control;
...@@ -840,7 +841,7 @@ static bool ath9k_rx_accept(struct ath_common *common, ...@@ -840,7 +841,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
* we can take a hint that hardware corrupted it, so ignore * we can take a hint that hardware corrupted it, so ignore
* those frames. * those frames.
*/ */
if (rx_stats->rs_datalen > common->rx_bufsize) if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len))
return false; return false;
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment