--- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -2400,20 +2400,16 @@ static int ath11k_dp_rx_process_msdu(str rxcb->rx_desc = rx_desc; msdu_len = ath11k_dp_rx_h_msdu_start_msdu_len(rx_desc); l3_pad_bytes = ath11k_dp_rx_h_msdu_end_l3pad(lrx_desc); - if ((msdu_len + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE) { - ath11k_warn(ar->ab, "invalid msdu len %u\n", msdu_len); - ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", rxcb->rx_desc, - sizeof(struct hal_rx_desc)); - ath11k_dp_dump_msdu_info(ar, rxcb->rx_desc, rxcb); - goto free_out; - } if (rxcb->is_frag) { skb_pull(msdu, HAL_RX_DESC_SIZE); } else if (!rxcb->is_continuation) { - if ((msdu_len + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE) { - ret = -EINVAL; + if ((msdu_len + l3_pad_bytes + HAL_RX_DESC_SIZE) > DP_RX_BUFFER_SIZE) { ath11k_warn(ar->ab, "invalid msdu len %u\n", msdu_len); + ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "", + rxcb->rx_desc, + sizeof(struct hal_rx_desc)); + ath11k_dp_dump_msdu_info(ar, rxcb->rx_desc, rxcb); goto free_out; } skb_put(msdu, HAL_RX_DESC_SIZE + l3_pad_bytes + msdu_len);