2 files changed, 4 insertions, 0 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index f138b195d657..002db5e86eb6 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -239,6 +239,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                 buf_size = buf_size << sband->ht_cap.ampdu_factor;
         }
 
+        /* make sure the size doesn't exceed the maximum supported by the hw */
+        if (buf_size > local->hw.max_rx_aggregation_subframes)
+                buf_size = local->hw.max_rx_aggregation_subframes;
 
         /* examine state machine */
         mutex_lock(&sta->ampdu_mlme.mtx);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 485d36bc9a46..1c507c6972e6 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -552,6 +552,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.queues = 1;
         local->hw.max_rates = 1;
         local->hw.max_report_rates = 0;
+        local->hw.max_rx_aggregation_subframes = IEEE80211_MAX_AMPDU_BUF;
         local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
         local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
         local->user_power_level = -1;