ath9k: Fix bug in validating received data length for edma

[firefly-linux-kernel-4.4.55.git] / drivers / net / wireless / ath / ath9k / recv.c

diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 978b4d91f93114bfb64a73211fd38808906502dc..1618f8fe195db4ad783e117baad6b15d4f4bae83 100644 (file)
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -830,6 +830,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
 {
        struct ath_hw *ah = common->ah;
        __le16 fc;
+       u8 rx_status_len = ah->caps.rx_status_len;
 
        fc = hdr->frame_control;
 
@@ -840,7 +841,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
          * we can take a hint that hardware corrupted it, so ignore
          * those frames.
          */
-       if (rx_stats->rs_datalen > common->rx_bufsize)
+       if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len))
                return false;
 
        /*