dma: validate skb length

Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
Felix Fietkau
2015-07-26 20:47:15 +02:00
parent 70746f1210
commit 05f85cdc88
+6 -1
View File
@@ -469,7 +469,12 @@ mt76_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q, int budget)
}
skb_reserve(skb, MT_RX_HEADROOM);
skb_put(skb, len);
if (skb->tail + len > skb->end) {
dev_kfree_skb(skb);
continue;
}
__skb_put(skb, len);
desc = &q->desc[idx];
mt76_process_rx_skb(dev, q, skb, le32_to_cpu(desc->info));