From 8b7f50d23610d2126053841450414eb01a577b86 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 6 Nov 2018 12:29:44 +0100 Subject: [PATCH] mt76: add size check for additional rx fragments So far the code only validates the buffer size of the first skb. Extend this check to cover additional fragments as well, in case the size is corrupted during a DMA reset. Signed-off-by: Felix Fietkau --- dma.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dma.c b/dma.c index d62f8d9f..3e066486 100644 --- a/dma.c +++ b/dma.c @@ -430,6 +430,14 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget) if (!data) break; + if (q->buf_size < len + q->buf_offset) { + dev_kfree_skb(q->rx_head); + q->rx_head = NULL; + + skb_free_frag(data); + continue; + } + if (q->rx_head) { mt76_add_fragment(dev, q, data, len, more); continue;