mirror of
https://github.com/outbackdingo/mt76.git
synced 2026-10-24 21:36:52 +00:00
mt76x2: fix headroom handling and buffer length check
Signed-off-by: Felix Fietkau <[email protected]>
This commit is contained in:
+3
-5
@@ -126,14 +126,11 @@ static void
|
||||
mt76x2_process_rx_skb(struct mt76x2_dev *dev, struct mt76_queue *q,
|
||||
struct sk_buff *skb, u32 info)
|
||||
{
|
||||
void *rxwi = skb->data - sizeof(struct mt76x2_rxwi);
|
||||
void *rxwi = skb->data;
|
||||
|
||||
if (q == &dev->mcu.q_rx) {
|
||||
u32 *rxfce;
|
||||
|
||||
/* No RXWI header, data starts with payload */
|
||||
skb_push(skb, sizeof(struct mt76x2_rxwi));
|
||||
|
||||
rxfce = (u32 *) skb->cb;
|
||||
*rxfce = info;
|
||||
|
||||
@@ -142,6 +139,7 @@ mt76x2_process_rx_skb(struct mt76x2_dev *dev, struct mt76_queue *q,
|
||||
return;
|
||||
}
|
||||
|
||||
skb_pull(skb, sizeof(struct mt76x2_rxwi));
|
||||
if (mt76x2_mac_process_rx(dev, skb, rxwi)) {
|
||||
dev_kfree_skb(skb);
|
||||
return;
|
||||
@@ -173,7 +171,7 @@ mt76x2_process_rx_queue(struct mt76x2_dev *dev, struct mt76_queue *q, int budget
|
||||
continue;
|
||||
}
|
||||
|
||||
skb_reserve(skb, MT_RX_HEADROOM);
|
||||
skb_reserve(skb, q->buf_offset);
|
||||
if (skb->tail + len > skb->end) {
|
||||
dev_kfree_skb(skb);
|
||||
continue;
|
||||
|
||||
Reference in New Issue
Block a user