diff options
| author | John W. Linville <linville@tuxdriver.com> | 2011-03-30 14:02:46 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-04-14 16:53:00 -0700 |
| commit | eb73bca39f4f5f2d5285dcb1dc1aa35433d89cef (patch) | |
| tree | 75aad8202b5e1ba80e62c9f9cc9f094c9dd585ce | |
| parent | 099e8c1a2988504dcd485a9a2f07e0a1ff0fb608 (diff) | |
| download | lwn-eb73bca39f4f5f2d5285dcb1dc1aa35433d89cef.tar.gz lwn-eb73bca39f4f5f2d5285dcb1dc1aa35433d89cef.zip | |
b43: allocate receive buffers big enough for max frame len + offset
commit c85ce65ecac078ab1a1835c87c4a6319cf74660a upstream.
Otherwise, skb_put inside of dma_rx can fail...
https://bugzilla.kernel.org/show_bug.cgi?id=32042
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/net/wireless/b43/dma.c | 2 | ||||
| -rw-r--r-- | drivers/net/wireless/b43/dma.h | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c index 615af22c49fd..7c6e74bff8cc 100644 --- a/drivers/net/wireless/b43/dma.c +++ b/drivers/net/wireless/b43/dma.c @@ -1554,7 +1554,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot) dmaaddr = meta->dmaaddr; goto drop_recycle_buffer; } - if (unlikely(len > ring->rx_buffersize)) { + if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) { /* The data did not fit into one descriptor buffer * and is split over multiple buffers. * This should never happen, as we try to allocate buffers diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h index f7ab37c4cdbc..077333991084 100644 --- a/drivers/net/wireless/b43/dma.h +++ b/drivers/net/wireless/b43/dma.h @@ -163,7 +163,7 @@ struct b43_dmadesc_generic { /* DMA engine tuning knobs */ #define B43_TXRING_SLOTS 256 #define B43_RXRING_SLOTS 64 -#define B43_DMA0_RX_BUFFERSIZE IEEE80211_MAX_FRAME_LEN +#define B43_DMA0_RX_BUFFERSIZE (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN) /* Pointer poison */ #define B43_DMA_PTR_POISON ((void *)ERR_PTR(-ENOMEM)) |