From e81df56c9e4381872e92c7bb502a4c853547ebbf Mon Sep 17 00:00:00 2001
From: "John W. Linville" <linville@tuxdriver.com>
Date: Mon, 1 Oct 2007 21:03:54 -0700
Subject: [PATCH] --- yaml --- r: 65247 b: refs/heads/master c:
 04045f98e0457aba7d4e6736f37eed189c48a5f7 h: refs/heads/master i:   65245:
 951dfbd6b91dcbfdcd95312aba9e2cac2c1e99bf   65243:
 2d5eefb06d497eea7ec65d08bfde67e56439f359   65239:
 af073f3a9c7f91b6fa776e7e75fd60b6825f665d   65231:
 690bfea25007f88570bb619162327b41ad6addab   65215:
 e01ff9bda46206c6027289686f2edd14e03018a7 v: v3

---
 [refs]                             | 2 +-
 trunk/net/ieee80211/ieee80211_rx.c | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index a4641b5f1e63..8598f5c0eb87 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 9b42c336d06411e6463949d2dac63949f66ff70b
+refs/heads/master: 04045f98e0457aba7d4e6736f37eed189c48a5f7
diff --git a/trunk/net/ieee80211/ieee80211_rx.c b/trunk/net/ieee80211/ieee80211_rx.c
index f2de2e48b021..6284c99b456e 100644
--- a/trunk/net/ieee80211/ieee80211_rx.c
+++ b/trunk/net/ieee80211/ieee80211_rx.c
@@ -366,6 +366,12 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 	frag = WLAN_GET_SEQ_FRAG(sc);
 	hdrlen = ieee80211_get_hdrlen(fc);
 
+	if (skb->len < hdrlen) {
+		printk(KERN_INFO "%s: invalid SKB length %d\n",
+			dev->name, skb->len);
+		goto rx_dropped;
+	}
+
 	/* Put this code here so that we avoid duplicating it in all
 	 * Rx paths. - Jean II */
 #ifdef CONFIG_WIRELESS_EXT