rt61pci_fill_rxdone() reports rxdesc.size from the 12-bit DATABYTE_COUNT field but, unlike the USB drivers, does not trim the skb to that length. rt2x00lib_rxdone() then computes the 802.11 header length from the untrimmed skb and can call rt2x00crypto_rx_insert_iv() while skb->len does not match rxdesc.size. Trim the skb at the end of rt61pci_fill_rxdone(), matching rt2500usb and rt73usb, so the skb length is correct before the header length is computed and before any IV/ICV data is reinserted. Signed-off-by: Heyang Tan Acked-by: Stanislaw Gruszka --- drivers/net/wireless/ralink/rt2x00/rt61pci.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/ralink/rt2x00/rt61pci.c b/drivers/net/wireless/ralink/rt2x00/rt61pci.c index d4783658b..bc0fb3cf9 100644 --- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c +++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c @@ -2051,6 +2051,7 @@ static void rt61pci_fill_rxdone(struct queue_entry *entry, rxdesc->dev_flags |= RXDONE_SIGNAL_BITRATE; if (rt2x00_get_field32(word0, RXD_W0_MY_BSS)) rxdesc->dev_flags |= RXDONE_MY_BSS; + skb_trim(entry->skb, rxdesc->size); } /* -- 2.34.1