From 8736be6e21053919bdf8f250d9467153af2de7d5 Mon Sep 17 00:00:00 2001 From: David Lin Date: Tue, 31 Mar 2015 16:10:25 +0800 Subject: Drop received frame with wrong channel information. Signed-off-by: David Lin --- mwl_rx.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/mwl_rx.c b/mwl_rx.c index f34c6db..c7a8c73 100644 --- a/mwl_rx.c +++ b/mwl_rx.c @@ -150,6 +150,12 @@ void mwl_rx_recv(unsigned long data) if (skb_tailroom(prx_skb) < pkt_len) { WLDBG_PRINT("Critical error: not enough tail room =%x pkt_len=%x, curr_desc=%x, curr_desc_data=%x", skb_tailroom(prx_skb), pkt_len, curr_desc, curr_desc->pbuff_data); + dev_kfree_skb_any(prx_skb); + goto out; + } + + if (curr_desc->channel != hw->conf.chandef.chan->hw_value) { + dev_kfree_skb_any(prx_skb); goto out; } @@ -205,10 +211,8 @@ void mwl_rx_recv(unsigned long data) mwl_rx_remove_dma_header(prx_skb, curr_desc->qos_ctrl); memcpy(IEEE80211_SKB_RXCB(prx_skb), &status, sizeof(status)); ieee80211_rx(hw, prx_skb); - - mwl_rx_refill(priv, curr_desc); - out: + mwl_rx_refill(priv, curr_desc); curr_desc->rx_control = EAGLE_RXD_CTRL_DRIVER_OWN; curr_desc->qos_ctrl = 0; curr_desc = curr_desc->pnext; -- cgit v1.2.3