[PATCH] wifi: rt2x00: rt61pci: trim RX skb to reported frame length

[PATCH] wifi: rt2x00: rt61pci: trim RX skb to reported frame length

[Heyang Tan]

rt61pci_fill_rxdone() reports rxdesc.size from the 12-bit
DATABYTE_COUNT field but, unlike the USB drivers, does not trim the skb
to that length.  rt2x00lib_rxdone() then computes the 802.11 header
length from the untrimmed skb and can call rt2x00crypto_rx_insert_iv()
while skb->len does not match rxdesc.size.

Trim the skb at the end of rt61pci_fill_rxdone(), matching rt2500usb and
rt73usb, so the skb length is correct before the header length is
computed and before any IV/ICV data is reinserted.

Signed-off-by: Heyang Tan <thy15333007817@163.com>
---
 drivers/net/wireless/ralink/rt2x00/rt61pci.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/ralink/rt2x00/rt61pci.c b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
index d4783658b..b2ee0cc14 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
@@ -2051,6 +2051,14 @@ static void rt61pci_fill_rxdone(struct queue_entry *entry,
 		rxdesc->dev_flags |= RXDONE_SIGNAL_BITRATE;
 	if (rt2x00_get_field32(word0, RXD_W0_MY_BSS))
 		rxdesc->dev_flags |= RXDONE_MY_BSS;
+
+	/*
+	 * Trim the skb to the reported frame length.  rt2x00lib_rxdone()
+	 * computes the 802.11 header length from the skb before calling
+	 * rt2x00crypto_rx_insert_iv(), and that function requires skb->len
+	 * to match rxdesc.size.
+	 */
+	skb_trim(entry->skb, rxdesc->size);
 }
 
 /*

-- 
2.34.1

Re: [PATCH] wifi: rt2x00: rt61pci: trim RX skb to reported frame length

[Stanislaw Gruszka]

On Fri, Oct 16, 2026 at 11:57:06AM +0800, Heyang Tan wrote:
> rt61pci_fill_rxdone() reports rxdesc.size from the 12-bit
> DATABYTE_COUNT field but, unlike the USB drivers, does not trim the skb
> to that length.  rt2x00lib_rxdone() then computes the 802.11 header
> length from the untrimmed skb and can call rt2x00crypto_rx_insert_iv()
> while skb->len does not match rxdesc.size.
>
> Trim the skb at the end of rt61pci_fill_rxdone(), matching rt2500usb and
> rt73usb, so the skb length is correct before the header length is
> computed and before any IV/ICV data is reinserted.
>
> Signed-off-by: Heyang Tan <thy15333007817@163.com>
> ---
>  drivers/net/wireless/ralink/rt2x00/rt61pci.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/net/wireless/ralink/rt2x00/rt61pci.c b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
> index d4783658b..b2ee0cc14 100644
> --- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
> +++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
> @@ -2051,6 +2051,14 @@ static void rt61pci_fill_rxdone(struct queue_entry *entry,
>  		rxdesc->dev_flags |= RXDONE_SIGNAL_BITRATE;
>  	if (rt2x00_get_field32(word0, RXD_W0_MY_BSS))
>  		rxdesc->dev_flags |= RXDONE_MY_BSS;
> +
> +	/*
> +	 * Trim the skb to the reported frame length.  rt2x00lib_rxdone()
> +	 * computes the 802.11 header length from the skb before calling
> +	 * rt2x00crypto_rx_insert_iv(), and that function requires skb->len
> +	 * to match rxdesc.size.
> +	 */
We don't need this comment IMHO.
> +	skb_trim(entry->skb, rxdesc->size);

Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>

Regards
Stanislaw