diff options
| author |   John W. Linville <linville@tuxdriver.com> | 2011-03-30 14:02:46 -0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-04-04 15:22:11 -0400 |
| commit | c85ce65ecac078ab1a1835c87c4a6319cf74660a (patch) | |
| tree | 25a5e2468e4c8622c7c11e4163078a0b752ddb14 /drivers/net/wireless/b43/dma.c | |
| parent | mlx4: fix kfree on error path in new_steering_entry() (diff) | |
| download | linux-dev-c85ce65ecac078ab1a1835c87c4a6319cf74660a.tar.xz linux-dev-c85ce65ecac078ab1a1835c87c4a6319cf74660a.zip | |
b43: allocate receive buffers big enough for max frame len + offset
Otherwise, skb_put inside of dma_rx can fail...
https://bugzilla.kernel.org/show_bug.cgi?id=32042
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: stable@kernel.org
Diffstat (limited to 'drivers/net/wireless/b43/dma.c')
| -rw-r--r-- | drivers/net/wireless/b43/dma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c index 3d5566e7af0a..ff0f5ba14b2c 100644 --- a/drivers/net/wireless/b43/dma.c +++ b/drivers/net/wireless/b43/dma.c @@ -1536,7 +1536,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot) dmaaddr = meta->dmaaddr; goto drop_recycle_buffer; } - if (unlikely(len > ring->rx_buffersize)) { + if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) { /* The data did not fit into one descriptor buffer * and is split over multiple buffers. * This should never happen, as we try to allocate buffers |