summaryrefslogtreecommitdiff
path: root/drivers/net
diff options
context:
space:
mode:
authorChristian Lamparter <chunkeey@googlemail.com>2010-03-23 21:51:14 +0100
committerGreg Kroah-Hartman <gregkh@suse.de>2010-07-05 11:15:37 -0700
commit774acedbe0450bf898db29f60cb155bbda2c6132 (patch)
treefec66a71802d9122542cbba77444b014ff20f165 /drivers/net
parent53d79eea5694856d540c19016feeb7f9d81f9d80 (diff)
downloadlwn-774acedbe0450bf898db29f60cb155bbda2c6132.tar.gz
lwn-774acedbe0450bf898db29f60cb155bbda2c6132.zip
ar9170usb: fix panic triggered by undersized rxstream buffer
commit 879999cec9489f8942ebce3ec1b5f23ef948dda7 upstream. While ar9170's USB transport packet size is currently set to 8KiB, the PHY is capable of receiving AMPDUs with up to 64KiB. Such a large frame will be split over several rx URBs and exceed the previously allocated space for rx stream reconstruction. This patch increases the buffer size to 64KiB which is in fact the phy & rx stream designed size limit. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=15591 Reported-by: Christian Mehlis <mehlis@inf.fu-berlin.de> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/wireless/ath/ar9170/hw.h1
-rw-r--r--drivers/net/wireless/ath/ar9170/main.c2
2 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ar9170/hw.h b/drivers/net/wireless/ath/ar9170/hw.h
index 701ddb7d8400..5e7e1bd0e484 100644
--- a/drivers/net/wireless/ath/ar9170/hw.h
+++ b/drivers/net/wireless/ath/ar9170/hw.h
@@ -424,5 +424,6 @@ enum ar9170_txq {
#define AR9170_TXQ_DEPTH 32
#define AR9170_TX_MAX_PENDING 128
+#define AR9170_RX_STREAM_MAX_SIZE 65535
#endif /* __AR9170_HW_H */
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index f9d6db8d013e..9ea98459d4b3 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -2538,7 +2538,7 @@ void *ar9170_alloc(size_t priv_size)
* tends to split the streams into seperate rx descriptors.
*/
- skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
+ skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL);
if (!skb)
goto err_nomem;