diff options
| author | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-10-02 10:34:49 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-10-02 10:34:49 -0700 |
| commit | 2b3b29080d702e5488f214276170ab46adc40ee5 (patch) | |
| tree | 53d719e8490fda0c24d3f503078d36400c813be9 /net/ieee80211 | |
| parent | e80eaf9904d5b19512265e1435372b2e12146a5f (diff) | |
| parent | 04045f98e0457aba7d4e6736f37eed189c48a5f7 (diff) | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[IEEE80211]: avoid integer underflow for runt rx frames
[TCP]: secure_tcp_sequence_number() should not use a too fast clock
[SFQ]: Remove artificial limitation for queue limit.
Diffstat (limited to 'net/ieee80211')
| -rw-r--r-- | net/ieee80211/ieee80211_rx.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c index f2de2e48b02..6284c99b456 100644 --- a/net/ieee80211/ieee80211_rx.c +++ b/net/ieee80211/ieee80211_rx.c @@ -366,6 +366,12 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb, frag = WLAN_GET_SEQ_FRAG(sc); hdrlen = ieee80211_get_hdrlen(fc); + if (skb->len < hdrlen) { + printk(KERN_INFO "%s: invalid SKB length %d\n", + dev->name, skb->len); + goto rx_dropped; + } + /* Put this code here so that we avoid duplicating it in all * Rx paths. - Jean II */ #ifdef CONFIG_WIRELESS_EXT |