diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index 860da13bfb6a..e6de23005a36 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -542,6 +542,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, int index = 0, i, len = skb->len; int rx_remain_len, rx_pkt_len; u16 pool_index = 0; + u16 pkt_tag; u8 *ptr; spin_lock(&hif_dev->rx_lock); @@ -559,6 +560,14 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, rx_remain_len -= hif_dev->rx_pad_len; ptr += rx_pkt_len; + pkt_tag = get_unaligned_le16(ptr + index + 2); + + if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) { + spin_unlock(&hif_dev->rx_lock); + RX_STAT_INC(skb_dropped); + return; + } + memcpy(ptr, skb->data, rx_remain_len); rx_pkt_len += rx_remain_len; @@ -576,7 +585,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, while (index < len) { u16 pkt_len; - u16 pkt_tag; u16 pad_len; int chk_idx;