[PATCH] wifi: rt2x00: rt61pci: trim RX skb to reported frame length

[Heyang Tan <thy15333007817@163.com>]

rt61pci_fill_rxdone() reports rxdesc.size from the 12-bit
DATABYTE_COUNT field but, unlike the USB drivers, does not trim the skb
to that length.  rt2x00lib_rxdone() then computes the 802.11 header
length from the untrimmed skb and can call rt2x00crypto_rx_insert_iv()
while skb->len does not match rxdesc.size.

Trim the skb at the end of rt61pci_fill_rxdone(), matching rt2500usb and
rt73usb, so the skb length is correct before the header length is
computed and before any IV/ICV data is reinserted.

Signed-off-by: Heyang Tan <thy15333007817@163.com>
---
 drivers/net/wireless/ralink/rt2x00/rt61pci.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/ralink/rt2x00/rt61pci.c b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
index d4783658b..b2ee0cc14 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt61pci.c
@@ -2051,6 +2051,14 @@ static void rt61pci_fill_rxdone(struct queue_entry *entry,
 		rxdesc->dev_flags |= RXDONE_SIGNAL_BITRATE;
 	if (rt2x00_get_field32(word0, RXD_W0_MY_BSS))
 		rxdesc->dev_flags |= RXDONE_MY_BSS;
+
+	/*
+	 * Trim the skb to the reported frame length.  rt2x00lib_rxdone()
+	 * computes the 802.11 header length from the skb before calling
+	 * rt2x00crypto_rx_insert_iv(), and that function requires skb->len
+	 * to match rxdesc.size.
+	 */
+	skb_trim(entry->skb, rxdesc->size);
 }
 
 /*

-- 
2.34.1