diff options
| author | Luis R. Rodriguez <lrodriguez@atheros.com> | 2009-11-04 15:11:05 -0800 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-11-11 17:09:08 -0500 |
| commit | 2c74aa4d73dbed2e879e7eb5ee9de95d40e5298d (patch) | |
| tree | 27f5b5046ced5180f276e9970b79c20d5464e113 | |
| parent | dd849782a7388e091e356373a744f8b7ae97188a (diff) | |
ath9k: move the max rx buffer size check to ath9k_rx_accept()
While at it flip the order, seems easier to read and also
add some better description as to why we do this check.
Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/recv.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c index 48ff77255d2..16ed9292c80 100644 --- a/drivers/net/wireless/ath/ath9k/recv.c +++ b/drivers/net/wireless/ath/ath9k/recv.c @@ -105,6 +105,13 @@ static bool ath9k_rx_accept(struct ath_common *common, if (!rx_stats->rs_datalen) return false; + /* + * rs_status follows rs_datalen so if rs_datalen is too large + * we can take a hint that hardware corrupted it, so ignore + * those frames. + */ + if (rx_stats->rs_datalen > common->rx_bufsize) + return false; if (rx_stats->rs_more) { /* @@ -801,10 +808,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush) if (flush) goto requeue; - /* The status portion of the descriptor could get corrupted. */ - if (common->rx_bufsize < rx_stats->rs_datalen) - goto requeue; - if (!ath_rx_prepare(common, hw, skb, rx_stats, rxs, &decrypt_error)) goto requeue; |