diff options
| author |   Christian Lamparter <chunkeey@googlemail.com> | 2010-03-23 21:51:14 +0100 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2010-03-31 14:50:51 -0400 |
| commit | 879999cec9489f8942ebce3ec1b5f23ef948dda7 (patch) | |
| tree | 7eaeb70e0b0f5a81aad162764e163b8b0e7588f5 /drivers/net/wireless/ath/ar9170/main.c | |
| parent | include/net/iw_handler.h: Use SIOCIWFIRST not SIOCSIWCOMMIT in comment (diff) | |
| download | linux-dev-879999cec9489f8942ebce3ec1b5f23ef948dda7.tar.xz linux-dev-879999cec9489f8942ebce3ec1b5f23ef948dda7.zip | |
ar9170usb: fix panic triggered by undersized rxstream buffer
While ar9170's USB transport packet size is currently set to 8KiB,
the PHY is capable of receiving AMPDUs with up to 64KiB.
Such a large frame will be split over several rx URBs and
exceed the previously allocated space for rx stream reconstruction.
This patch increases the buffer size to 64KiB which is
in fact the phy & rx stream designed size limit.
Cc: stable@kernel.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=15591
Reported-by: Christian Mehlis <mehlis@inf.fu-berlin.de>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ath/ar9170/main.c')
| -rw-r--r-- | drivers/net/wireless/ath/ar9170/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c index f4650fcdebc9..2daeaa5bcb88 100644 --- a/drivers/net/wireless/ath/ar9170/main.c +++ b/drivers/net/wireless/ath/ar9170/main.c @@ -2515,7 +2515,7 @@ void *ar9170_alloc(size_t priv_size) * tends to split the streams into seperate rx descriptors. */ - skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL); + skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL); if (!skb) goto err_nomem; |