From b7b1b512287d6917d4976a4ee0e7d72c4edf52eb Mon Sep 17 00:00:00 2001
From: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Date: Thu, 20 May 2010 14:34:48 -0700
Subject: [PATCH] ath9k: Fix bug in validating received data length for edma

The rx status length should also be taken into account while
validating the length of a received frame.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---
 drivers/net/wireless/ath/ath9k/recv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 978b4d91f931..1618f8fe195d 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -830,6 +830,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
 {
 	struct ath_hw *ah = common->ah;
 	__le16 fc;
+	u8 rx_status_len = ah->caps.rx_status_len;
 
 	fc = hdr->frame_control;
 
@@ -840,7 +841,7 @@ static bool ath9k_rx_accept(struct ath_common *common,
          * we can take a hint that hardware corrupted it, so ignore
          * those frames.
          */
-	if (rx_stats->rs_datalen > common->rx_bufsize)
+	if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len))
 		return false;
 
 	/*
-- 
2.34.1