diff --git a/mt76.h b/mt76.h index f4dc4a66..6301f1af 100644 --- a/mt76.h +++ b/mt76.h @@ -30,7 +30,6 @@ #define MT_TX_RING_SIZE 256 #define MT_MCU_RING_SIZE 32 #define MT_RX_BUF_SIZE 2048 -#define MT_SKB_HEAD_LEN 128 struct mt76_dev; struct mt76_wcid; diff --git a/usb.c b/usb.c index 2bfc8214..bbaa1365 100644 --- a/usb.c +++ b/usb.c @@ -429,48 +429,6 @@ static int mt76u_get_rx_entry_len(u8 *data, u32 data_len) return dma_len; } -static struct sk_buff * -mt76u_build_rx_skb(u8 *data, int len, int buf_size, - int *nsgs) -{ - int data_len = min(len, MT_SKB_HEAD_LEN); - struct sk_buff *skb; - - if (SKB_WITH_OVERHEAD(buf_size) >= MT_DMA_HDR_LEN + len) { - /* fast path */ - skb = build_skb(data, buf_size); - if (!skb) - return NULL; - - skb_reserve(skb, MT_DMA_HDR_LEN); - __skb_put(skb, len); - - return skb; - } - - /* slow path, not enough space for data and - * skb_shared_info - */ - skb = alloc_skb(data_len, GFP_ATOMIC); - if (!skb) - return NULL; - - skb_put_data(skb, data + MT_DMA_HDR_LEN, data_len); - data += (data_len + MT_DMA_HDR_LEN); - len -= data_len; - if (len > 0) { - struct page *page = virt_to_head_page(data); - int offset = data - (u8 *)page_address(page); - - skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, - page, offset, len, buf_size); - } else { - *nsgs = 0; - } - - return skb; -} - static int mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb) { @@ -488,11 +446,19 @@ mt76u_process_rx_entry(struct mt76_dev *dev, struct urb *urb) return 0; data_len = min_t(int, len, data_len - MT_DMA_HDR_LEN); - skb = mt76u_build_rx_skb(data, data_len, q->buf_size, &nsgs); + if (MT_DMA_HDR_LEN + data_len > SKB_WITH_OVERHEAD(q->buf_size)) { + dev_err_ratelimited(dev->dev, "rx data too big %d\n", data_len); + return 0; + } + + skb = build_skb(data, q->buf_size); if (!skb) return 0; + skb_reserve(skb, MT_DMA_HDR_LEN); + __skb_put(skb, data_len); len -= data_len; + while (len > 0 && nsgs < urb->num_sgs) { data_len = min_t(int, len, urb->sg[nsgs].length); skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,