1:  b6ab6f1d53a7 ! 1:  8bf1d6953889 wifi: rtl8180: reject RX frames longer than MAX_RX_SIZE
    @@ Commit message
         allocated with dev_alloc_skb(MAX_RX_SIZE), so a descriptor length above
         MAX_RX_SIZE extends the skb past its allocated tailroom.
     
    -    Drop such frames before allocating the replacement RX skb.
    +    Store the reported length in a local variable and drop the frame before
    +    allocating the replacement RX skb when it exceeds MAX_RX_SIZE.
     
         Signed-off-by: Jiaxin Li <18135327133@163.com>
     
    @@ drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c: static void rtl8180_handle_r
      			struct ieee80211_rx_status rx_status = {0};
     -			struct sk_buff *new_skb = dev_alloc_skb(MAX_RX_SIZE);
     +			struct sk_buff *new_skb;
    ++			u32 rx_len = flags & 0xFFF;
     +
    -+			if (unlikely((flags & 0xFFF) > MAX_RX_SIZE))
    ++			if (unlikely(rx_len > MAX_RX_SIZE))
     +				goto done;
     +
     +			new_skb = dev_alloc_skb(MAX_RX_SIZE);
      
      			if (unlikely(!new_skb))
      				goto done;
    +@@ drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c: static void rtl8180_handle_rx(struct ieee80211_hw *dev)
    + 			dma_unmap_single(&priv->pdev->dev,
    + 					 *((dma_addr_t *)skb->cb),
    + 					 MAX_RX_SIZE, DMA_FROM_DEVICE);
    +-			skb_put(skb, flags & 0xFFF);
    ++			skb_put(skb, rx_len);
    + 
    + 			rx_status.antenna = (flags2 >> 15) & 1;
    + 			rx_status.rate_idx = (flags >> 20) & 0xF;