Commit bbd1347b authored by Ivan Safonov's avatar Ivan Safonov Committed by Greg Kroah-Hartman

staging:r8188eu: avoid skb_clone for amsdu to msdu conversion

[ Upstream commit 628cbd97 ]

skb clones use same data buffer,
so tail of one skb is corrupted by beginning of next skb.
Signed-off-by: default avatarIvan Safonov <insafonov@gmail.com>
Link: https://lore.kernel.org/r/20200423191404.12028-1-insafonov@gmail.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 31662a5a
...@@ -1535,21 +1535,14 @@ static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe) ...@@ -1535,21 +1535,14 @@ static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
/* Allocate new skb for releasing to upper layer */ /* Allocate new skb for releasing to upper layer */
sub_skb = dev_alloc_skb(nSubframe_Length + 12); sub_skb = dev_alloc_skb(nSubframe_Length + 12);
if (sub_skb) { if (!sub_skb) {
skb_reserve(sub_skb, 12); DBG_88E("dev_alloc_skb() Fail!!! , nr_subframes=%d\n", nr_subframes);
skb_put_data(sub_skb, pdata, nSubframe_Length); break;
} else {
sub_skb = skb_clone(prframe->pkt, GFP_ATOMIC);
if (sub_skb) {
sub_skb->data = pdata;
sub_skb->len = nSubframe_Length;
skb_set_tail_pointer(sub_skb, nSubframe_Length);
} else {
DBG_88E("skb_clone() Fail!!! , nr_subframes=%d\n", nr_subframes);
break;
}
} }
skb_reserve(sub_skb, 12);
skb_put_data(sub_skb, pdata, nSubframe_Length);
subframes[nr_subframes++] = sub_skb; subframes[nr_subframes++] = sub_skb;
if (nr_subframes >= MAX_SUBFRAME_COUNT) { if (nr_subframes >= MAX_SUBFRAME_COUNT) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment