From patchwork Sat Nov 7 20:18:59 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Rodriguez X-Patchwork-Id: 58361 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id nA7KJsuP011493 for ; Sat, 7 Nov 2009 20:19:54 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752979AbZKGUTq (ORCPT ); Sat, 7 Nov 2009 15:19:46 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753000AbZKGUTp (ORCPT ); Sat, 7 Nov 2009 15:19:45 -0500 Received: from bombadil.infradead.org ([18.85.46.34]:56146 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752835AbZKGUTC (ORCPT ); Sat, 7 Nov 2009 15:19:02 -0500 Received: from mcgrof by bombadil.infradead.org with local (Exim 4.69 #1 (Red Hat Linux)) id 1N6rkZ-0004hS-WA; Sat, 07 Nov 2009 20:19:08 +0000 From: "Luis R. Rodriguez" To: linville@tuxdriver.com Cc: linux-wireless@vger.kernel.org, devel@driverdev.osuosl.org, mcgrof@gmail.com, "Luis R. Rodriguez" Subject: [PATCH 22/29] ath9k: move the max rx buffer size check to ath9k_rx_accept() Date: Sat, 7 Nov 2009 15:18:59 -0500 Message-Id: <1257625146-17971-23-git-send-email-lrodriguez@atheros.com> X-Mailer: git-send-email 1.6.2.rc1.3.g81d3f In-Reply-To: <1257625146-17971-1-git-send-email-lrodriguez@atheros.com> References: <1257625146-17971-1-git-send-email-lrodriguez@atheros.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c index 48ff772..16ed929 100644 --- a/drivers/net/wireless/ath/ath9k/recv.c +++ b/drivers/net/wireless/ath/ath9k/recv.c @@ -105,6 +105,13 @@ static bool ath9k_rx_accept(struct ath_common *common, if (!rx_stats->rs_datalen) return false; + /* + * rs_status follows rs_datalen so if rs_datalen is too large + * we can take a hint that hardware corrupted it, so ignore + * those frames. + */ + if (rx_stats->rs_datalen > common->rx_bufsize) + return false; if (rx_stats->rs_more) { /* @@ -801,10 +808,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush) if (flush) goto requeue; - /* The status portion of the descriptor could get corrupted. */ - if (common->rx_bufsize < rx_stats->rs_datalen) - goto requeue; - if (!ath_rx_prepare(common, hw, skb, rx_stats, rxs, &decrypt_error)) goto requeue;