diff options
| author | Stephen Rothwell <sfr@canb.auug.org.au> | 2011-07-25 13:59:46 -0400 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2011-07-25 14:53:52 -0400 |
| commit | 5f00bcb38ef9a980a33c6dbdc0044964b05f22dd (patch) | |
| tree | 3175fb9375aecb50bde1be0bf4fa8aa8155131d6 /drivers/net/wireless/rt2x00/rt2x00dev.c | |
| parent | 34006cee28f7344f9557a4be3816c7891b1bbab1 (diff) | |
| parent | b6844e8f64920cdee620157252169ba63afb0c89 (diff) | |
Merge branch 'master' into devel and apply fixup from Stephen Rothwell:
vfs/nfs: fixup for nfs_open_context change
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'drivers/net/wireless/rt2x00/rt2x00dev.c')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt2x00dev.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c index 939821b4af2..0955c941317 100644 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c @@ -583,6 +583,18 @@ void rt2x00lib_rxdone(struct queue_entry *entry) rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc); /* + * Check for valid size in case we get corrupted descriptor from + * hardware. + */ + if (unlikely(rxdesc.size == 0 || + rxdesc.size > entry->queue->data_size)) { + WARNING(rt2x00dev, "Wrong frame size %d max %d.\n", + rxdesc.size, entry->queue->data_size); + dev_kfree_skb(entry->skb); + goto renew_skb; + } + + /* * The data behind the ieee80211 header must be * aligned on a 4 byte boundary. */ @@ -642,6 +654,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry) ieee80211_rx_ni(rt2x00dev->hw, entry->skb); +renew_skb: /* * Replace the skb with the freshly allocated one. */ |