Merge tag 'spi-fix-v4.9-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

[cascardo/linux.git] / drivers / net / wireless / realtek / rtl8xxxu / rtl8xxxu_core.c

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index b2d7f6e..a5e6ec2 100644 (file)
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -5197,7 +5197,12 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
                pkt_offset = roundup(pkt_len + drvinfo_sz + desc_shift +
                                     sizeof(struct rtl8xxxu_rxdesc16), 128);
 
-               if (pkt_cnt > 1)
+               /*
+                * Only clone the skb if there's enough data at the end to
+                * at least cover the rx descriptor
+                */
+               if (pkt_cnt > 1 &&
+                   urb_len > (pkt_offset + sizeof(struct rtl8xxxu_rxdesc16)))
                        next_skb = skb_clone(skb, GFP_ATOMIC);
 
                rx_status = IEEE80211_SKB_RXCB(skb);
@@ -5215,7 +5220,7 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
                        rtl8xxxu_rx_parse_phystats(priv, rx_status, phy_stats,
                                                   rx_desc->rxmcs);
 
-               rx_status->mactime = le32_to_cpu(rx_desc->tsfl);
+               rx_status->mactime = rx_desc->tsfl;
                rx_status->flag |= RX_FLAG_MACTIME_START;
 
                if (!rx_desc->swdec)
@@ -5285,7 +5290,7 @@ int rtl8xxxu_parse_rxdesc24(struct rtl8xxxu_priv *priv, struct sk_buff *skb)
                rtl8xxxu_rx_parse_phystats(priv, rx_status, phy_stats,
                                           rx_desc->rxmcs);
 
-       rx_status->mactime = le32_to_cpu(rx_desc->tsfl);
+       rx_status->mactime = rx_desc->tsfl;
        rx_status->flag |= RX_FLAG_MACTIME_START;
 
        if (!rx_desc->swdec)