|
@@ -105,6 +105,13 @@ static bool ath9k_rx_accept(struct ath_common *common,
|
|
|
|
|
|
if (!rx_stats->rs_datalen)
|
|
|
return false;
|
|
|
+ /*
|
|
|
+ * rs_status follows rs_datalen so if rs_datalen is too large
|
|
|
+ * we can take a hint that hardware corrupted it, so ignore
|
|
|
+ * those frames.
|
|
|
+ */
|
|
|
+ if (rx_stats->rs_datalen > common->rx_bufsize)
|
|
|
+ return false;
|
|
|
|
|
|
if (rx_stats->rs_more) {
|
|
|
/*
|
|
@@ -801,10 +808,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
|
|
|
if (flush)
|
|
|
goto requeue;
|
|
|
|
|
|
- /* The status portion of the descriptor could get corrupted. */
|
|
|
- if (common->rx_bufsize < rx_stats->rs_datalen)
|
|
|
- goto requeue;
|
|
|
-
|
|
|
if (!ath_rx_prepare(common, hw, skb, rx_stats,
|
|
|
rxs, &decrypt_error))
|
|
|
goto requeue;
|