1 files changed, 13 insertions, 0 deletions

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 00f908d9275e..a7263fc476bd 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1443,6 +1443,7 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ieee80211_sub_if_data *prev = NULL;
         struct sk_buff *skb_new;
         u8 *bssid;
+        int hdrlen;
 
         /*
          * key references and virtual interfaces are protected using RCU
@@ -1472,6 +1473,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
         rx.fc = le16_to_cpu(hdr->frame_control);
         type = rx.fc & IEEE80211_FCTL_FTYPE;
 
+        /*
+         * Drivers are required to align the payload data to a four-byte
+         * boundary, so the last two bits of the address where it starts
+         * may not be set. The header is required to be directly before
+         * the payload data, padding like atheros hardware adds which is
+         * inbetween the 802.11 header and the payload is not supported,
+         * the driver is required to move the 802.11 header further back
+         * in that case.
+         */
+        hdrlen = ieee80211_get_hdrlen(rx.fc);
+        WARN_ON_ONCE(((unsigned long)(skb->data + hdrlen)) & 3);
+
         if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
                 local->dot11ReceivedFragmentCount++;