diff options
| author | Cathy Luo <cluo@marvell.com> | 2016-07-21 14:00:24 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2016-08-18 16:02:08 +0300 |
| commit | c81396f3da22aa8f1e8fbf7943616a0839c4d63d (patch) | |
| tree | ca22e7a196d9eba407905cf239d2461f9fd94c65 /drivers/net/wireless | |
| parent | 184ca823481c99dadd7d946e5afd4bb921eab30d (diff) | |
| download | linux-c81396f3da22aa8f1e8fbf7943616a0839c4d63d.tar.xz | |
mwifiex: fix large amsdu packets causing firmware hang
Sometimes host prepares and downloads a large amsdu packet to firmware
which leads to a memory corruption in firmware.
The reason is __dev_alloc_skb() may allocate larger buffer than required
size. This patch solves the problem by checking "adapter->tx_buf_size"
instead of relying on skb_tailroom().
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c index dc49c3de1f25..c47d6366875d 100644 --- a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c +++ b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c @@ -205,7 +205,8 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv, do { /* Check if AMSDU can accommodate this MSDU */ - if (skb_tailroom(skb_aggr) < (skb_src->len + LLC_SNAP_LEN)) + if ((skb_aggr->len + skb_src->len + LLC_SNAP_LEN) > + adapter->tx_buf_size) break; skb_src = skb_dequeue(&pra_list->skb_head); |