Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git...

[uclinux-h8/linux.git] / drivers / net / wireless / rsi / rsi_91x_main.c

diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
index c7f5cec..f9f0044 100644 (file)
--- a/drivers/net/wireless/rsi/rsi_91x_main.c
+++ b/drivers/net/wireless/rsi/rsi_91x_main.c
@@ -23,6 +23,7 @@
 #include "rsi_common.h"
 #include "rsi_coex.h"
 #include "rsi_hal.h"
+#include "rsi_usb.h"
 
 u32 rsi_zone_enabled = /* INFO_ZONE |
                        INIT_ZONE |
@@ -168,6 +169,9 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt, s32 rcv_pkt_len)
                frame_desc = &rx_pkt[index];
                actual_length = *(u16 *)&frame_desc[0];
                offset = *(u16 *)&frame_desc[2];
+               if (!rcv_pkt_len && offset >
+                       RSI_MAX_RX_USB_PKT_SIZE - FRAME_DESC_SZ)
+                       goto fail;
 
                queueno = rsi_get_queueno(frame_desc, offset);
                length = rsi_get_length(frame_desc, offset);