diff options
| author | Felix Fietkau <nbd@nbd.name> | 2018-11-06 14:29:44 +0300 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2019-01-11 17:10:14 +0300 |
| commit | 9fe310546559d123103c39dc85eb54dc1316f450 (patch) | |
| tree | 5d8ec6280728a805971ecada8ed0a34a41ea856f | |
| parent | 4ad0be160544ffbdafb7cec39bb8e6dd0a97317a (diff) | |
| download | linux-9fe310546559d123103c39dc85eb54dc1316f450.tar.xz | |
mt76: add size check for additional rx fragments
So far the code only validates the buffer size of the first skb.
Extend this check to cover additional fragments as well, in case the size
is corrupted during a DMA reset.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/dma.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c index e2ba26378575..710a77fccf63 100644 --- a/drivers/net/wireless/mediatek/mt76/dma.c +++ b/drivers/net/wireless/mediatek/mt76/dma.c @@ -430,6 +430,14 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget) if (!data) break; + if (q->buf_size < len + q->buf_offset) { + dev_kfree_skb(q->rx_head); + q->rx_head = NULL; + + skb_free_frag(data); + continue; + } + if (q->rx_head) { mt76_add_fragment(dev, q, data, len, more); continue; |