b43: allocate receive buffers big enough for max frame len + offset

commit c85ce65ecac078ab1a1835c87c4a6319cf74660a upstream.

Otherwise, skb_put inside of dma_rx can fail...

	https://bugzilla.kernel.org/show_bug.cgi?id=32042

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 615af22c49fd1f34df3ad688841e4b7643caa843..7c6e74bff8ccf6e107ff80a2d8de2d542f021327 100644 (file)
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1554,7 +1554,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                dmaaddr = meta->dmaaddr;
                goto drop_recycle_buffer;
        }
-       if (unlikely(len > ring->rx_buffersize)) {
+       if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
                /* The data did not fit into one descriptor buffer
                 * and is split over multiple buffers.
                 * This should never happen, as we try to allocate buffers

diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index f7ab37c4cdbc8dfa88301c5384c91650e1046f63..0773339910840216e9d11a0deaf5af6e0b96b0ef 100644 (file)
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -163,7 +163,7 @@ struct b43_dmadesc_generic {
 /* DMA engine tuning knobs */
 #define B43_TXRING_SLOTS               256
 #define B43_RXRING_SLOTS               64
-#define B43_DMA0_RX_BUFFERSIZE         IEEE80211_MAX_FRAME_LEN
+#define B43_DMA0_RX_BUFFERSIZE         (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)
 
 /* Pointer poison */
 #define B43_DMA_PTR_POISON             ((void *)ERR_PTR(-ENOMEM))