diff options
| author | John W. Linville <linville@tuxdriver.com> | 2011-06-24 15:25:51 -0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-06-24 15:25:51 -0400 |
| commit | 36099365c7cc64e5184b66b6eb094950a13f540c (patch) | |
| tree | c91b9f3719f94864a62f2d15a71aaecd54c56711 /drivers/net/wireless/rt2x00 | |
| parent | 22c8c9343258feda9ea9ebb9e5f8cbb727b69454 (diff) | |
| parent | f70490e6078abe1182437e629f67a7f0b6f08cd4 (diff) | |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem
Conflicts:
drivers/net/wireless/rtlwifi/pci.c
include/linux/netlink.h
Diffstat (limited to 'drivers/net/wireless/rt2x00')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt2x00dev.c | 13 | ||||
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt2x00usb.c | 1 |
2 files changed, 14 insertions, 0 deletions
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c index 939821b4af2f..0955c941317f 100644 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c @@ -583,6 +583,18 @@ void rt2x00lib_rxdone(struct queue_entry *entry) rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc); /* + * Check for valid size in case we get corrupted descriptor from + * hardware. + */ + if (unlikely(rxdesc.size == 0 || + rxdesc.size > entry->queue->data_size)) { + WARNING(rt2x00dev, "Wrong frame size %d max %d.\n", + rxdesc.size, entry->queue->data_size); + dev_kfree_skb(entry->skb); + goto renew_skb; + } + + /* * The data behind the ieee80211 header must be * aligned on a 4 byte boundary. */ @@ -642,6 +654,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry) ieee80211_rx_ni(rt2x00dev->hw, entry->skb); +renew_skb: /* * Replace the skb with the freshly allocated one. */ diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c index 8f90f6268077..b6b4542c2460 100644 --- a/drivers/net/wireless/rt2x00/rt2x00usb.c +++ b/drivers/net/wireless/rt2x00/rt2x00usb.c @@ -802,6 +802,7 @@ int rt2x00usb_probe(struct usb_interface *usb_intf, int retval; usb_dev = usb_get_dev(usb_dev); + usb_reset_device(usb_dev); hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw); if (!hw) { |