From f6dc438bad2750d4f3335105444226585d8d7b8a Mon Sep 17 00:00:00 2001 From: "Luis R. Rodriguez" Date: Wed, 4 Nov 2009 15:11:05 -0800 Subject: [PATCH] --- yaml --- r: 171707 b: refs/heads/master c: 2c74aa4d73dbed2e879e7eb5ee9de95d40e5298d h: refs/heads/master i: 171705: 1967f1849a2220245a9b0f020323e9d75cd6f810 171703: d9e82a97cba52a35eed289cfc30088e804a6af0c v: v3 --- [refs] | 2 +- trunk/drivers/net/wireless/ath/ath9k/recv.c | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/[refs] b/[refs] index 55ce0208bdfa..eae055010b5e 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: dd849782a7388e091e356373a744f8b7ae97188a +refs/heads/master: 2c74aa4d73dbed2e879e7eb5ee9de95d40e5298d diff --git a/trunk/drivers/net/wireless/ath/ath9k/recv.c b/trunk/drivers/net/wireless/ath/ath9k/recv.c index 48ff77255d2f..16ed9292c805 100644 --- a/trunk/drivers/net/wireless/ath/ath9k/recv.c +++ b/trunk/drivers/net/wireless/ath/ath9k/recv.c @@ -105,6 +105,13 @@ static bool ath9k_rx_accept(struct ath_common *common, if (!rx_stats->rs_datalen) return false; + /* + * rs_status follows rs_datalen so if rs_datalen is too large + * we can take a hint that hardware corrupted it, so ignore + * those frames. + */ + if (rx_stats->rs_datalen > common->rx_bufsize) + return false; if (rx_stats->rs_more) { /* @@ -801,10 +808,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush) if (flush) goto requeue; - /* The status portion of the descriptor could get corrupted. */ - if (common->rx_bufsize < rx_stats->rs_datalen) - goto requeue; - if (!ath_rx_prepare(common, hw, skb, rx_stats, rxs, &decrypt_error)) goto requeue;