Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c85ce65e authored by John W. Linville's avatar John W. Linville
Browse files

b43: allocate receive buffers big enough for max frame len + offset 

Otherwise, skb_put inside of dma_rx can fail...

	https://bugzilla.kernel.org/show_bug.cgi?id=32042



Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
Acked-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
Cc: stable@kernel.org
parent a14b289d

drivers/net/wireless/b43/dma.c

+1 −1
Original line number Diff line number Diff line
@@ -1536,7 +1536,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot) 
		dmaaddr = meta->dmaaddr;

		goto drop_recycle_buffer;

	}

	if (unlikely(len > ring->rx_buffersize)) {

	if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {

		/* The data did not fit into one descriptor buffer

		 * and is split over multiple buffers.

		 * This should never happen, as we try to allocate buffers

drivers/net/wireless/b43/dma.h

+1 −1
Original line number Diff line number Diff line
@@ -163,7 +163,7 @@ struct b43_dmadesc_generic { 
/* DMA engine tuning knobs */

#define B43_TXRING_SLOTS		256

#define B43_RXRING_SLOTS		64

#define B43_DMA0_RX_BUFFERSIZE		IEEE80211_MAX_FRAME_LEN

#define B43_DMA0_RX_BUFFERSIZE		(B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)



/* Pointer poison */

#define B43_DMA_PTR_POISON		((void *)ERR_PTR(-ENOMEM))