diff options
| author | Vasanthakumar Thiagarajan <vasanth@atheros.com> | 2010-05-21 01:34:48 +0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-06-03 00:13:32 +0400 |
| commit | b7b1b512287d6917d4976a4ee0e7d72c4edf52eb (patch) | |
| tree | 2e098ddf22ccd61cb09159aec3b9a236ebcc1f8a /drivers/net/wireless/ath/ath9k/recv.c | |
| parent | 5c6dd921776946d12cbbae8ab92c5d6773b25810 (diff) | |
| download | linux-b7b1b512287d6917d4976a4ee0e7d72c4edf52eb.tar.xz | |
ath9k: Fix bug in validating received data length for edma
The rx status length should also be taken into account while
validating the length of a received frame.
Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath9k/recv.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/recv.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c index 978b4d91f931..1618f8fe195d 100644 --- a/drivers/net/wireless/ath/ath9k/recv.c +++ b/drivers/net/wireless/ath/ath9k/recv.c @@ -830,6 +830,7 @@ static bool ath9k_rx_accept(struct ath_common *common, { struct ath_hw *ah = common->ah; __le16 fc; + u8 rx_status_len = ah->caps.rx_status_len; fc = hdr->frame_control; @@ -840,7 +841,7 @@ static bool ath9k_rx_accept(struct ath_common *common, * we can take a hint that hardware corrupted it, so ignore * those frames. */ - if (rx_stats->rs_datalen > common->rx_bufsize) + if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len)) return false; /* |