From 05f85cdc88eab57e01e8bbf45f13c9f102493bb8 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@openwrt.org>
Date: Sun, 26 Jul 2015 20:47:15 +0200
Subject: [PATCH] dma: validate skb length

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
---
 dma.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dma.c b/dma.c
index d60cbca7..a498e2c7 100644
--- a/dma.c
+++ b/dma.c
@@ -469,7 +469,12 @@ mt76_process_rx_queue(struct mt76_dev *dev, struct mt76_queue *q, int budget)
 		}
 
 		skb_reserve(skb, MT_RX_HEADROOM);
-		skb_put(skb, len);
+		if (skb->tail + len > skb->end) {
+			dev_kfree_skb(skb);
+			continue;
+		}
+
+		__skb_put(skb, len);
 
 		desc = &q->desc[idx];
 		mt76_process_rx_skb(dev, q, skb, le32_to_cpu(desc->info));