PWN-Hunter/android_kernel_xiaomi_sdm845
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ath9k: Fix bug in validating received data length for edma

Browse Source 
The rx status length should also be taken into account while
validating the length of a received frame.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Vasanthakumar Thiagarajan 2010-05-20 14:34:48 -07:00 committed by John W. Linville
parent 5c6dd92177
commit b7b1b51228
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/wireless/ath/ath9k/recv.c
View File

@ -830,6 +830,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
{
struct ath_hw *ah = common->ah;
__le16 fc;
u8 rx_status_len = ah->caps.rx_status_len;
fc = hdr->frame_control;
@ -840,7 +841,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
* we can take a hint that hardware corrupted it, so ignore
* those frames.
*/
if (rx_stats->rs_datalen > common->rx_bufsize)
if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len))
return false;
/*