[PATCH 1/3] mt76: add size check for additional rx fragments

[Felix Fietkau]

So far the code only validates the buffer size of the first skb.
Extend this check to cover additional fragments as well, in case the size
is corrupted during a DMA reset.

Signed-off-by: Felix Fietkau <n...@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c 
b/drivers/net/wireless/mediatek/mt76/dma.c
index e2ba26378575..710a77fccf63 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -430,6 +430,14 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct 
mt76_queue *q, int budget)
                if (!data)
                        break;
 
+               if (q->buf_size < len + q->buf_offset) {
+                       dev_kfree_skb(q->rx_head);
+                       q->rx_head = NULL;
+
+                       skb_free_frag(data);
+                       continue;
+               }
+
                if (q->rx_head) {
                        mt76_add_fragment(dev, q, data, len, more);
                        continue;
-- 
2.17.0