return WLCORE_RX_BUF_ALIGNED;
 }
 
+static u32 wl12xx_get_rx_packet_len(struct wl1271 *wl, void *rx_data,
+                                   u32 data_len)
+{
+       struct wl1271_rx_descriptor *desc = rx_data;
+
+       /* invalid packet */
+       if (data_len < sizeof(*desc) ||
+           data_len < sizeof(*desc) + desc->pad_len)
+               return 0;
+
+       return data_len - sizeof(*desc) - desc->pad_len;
+}
+
 static bool wl12xx_mac_in_fuse(struct wl1271 *wl)
 {
        bool supported = false;
        .set_tx_desc_blocks     = wl12xx_set_tx_desc_blocks,
        .set_tx_desc_data_len   = wl12xx_set_tx_desc_data_len,
        .get_rx_buf_align       = wl12xx_get_rx_buf_align,
+       .get_rx_packet_len      = wl12xx_get_rx_packet_len,
        .get_pg_ver             = wl12xx_get_pg_ver,
        .get_mac                = wl12xx_get_mac,
 };
 
                wl->ops->prepare_read(wl, rx_desc, len);
 }
 
+static inline u32
+wlcore_hw_get_rx_packet_len(struct wl1271 *wl, void *rx_data, u32 data_len)
+{
+       if (!wl->ops->get_rx_packet_len)
+               BUG_ON(1);
+
+       return wl->ops->get_rx_packet_len(wl, rx_data, data_len);
+}
+
 #endif
 
        u8 is_data = 0;
        u8 reserved = 0;
        u16 seq_num;
+       u32 pkt_data_len;
 
        /*
         * In PLT mode we seem to get frames and mac80211 warns about them,
        if (unlikely(wl->plt))
                return -EINVAL;
 
+       pkt_data_len = wlcore_hw_get_rx_packet_len(wl, data, length);
+       if (!pkt_data_len) {
+               wl1271_error("Invalid packet arrived from HW. length %d",
+                            length);
+               return -EINVAL;
+       }
+
        if (rx_align == WLCORE_RX_BUF_UNALIGNED)
                reserved = NET_IP_ALIGN;
 
                return -EINVAL;
        }
 
-       /* skb length not included rx descriptor */
-       skb = __dev_alloc_skb(length + reserved - sizeof(*desc), GFP_KERNEL);
+       /* skb length not including rx descriptor */
+       skb = __dev_alloc_skb(pkt_data_len + reserved, GFP_KERNEL);
        if (!skb) {
                wl1271_error("Couldn't allocate RX frame");
                return -ENOMEM;
        /* reserve the unaligned payload(if any) */
        skb_reserve(skb, reserved);
 
-       buf = skb_put(skb, length - sizeof(*desc));
+       buf = skb_put(skb, pkt_data_len);
 
        /*
         * Copy packets from aggregation buffer to the skbs without rx
         * packets copy the packets in offset of 2 bytes guarantee IP header
         * payload aligned to 4 bytes.
         */
-       memcpy(buf, data + sizeof(*desc), length - sizeof(*desc));
+       memcpy(buf, data + sizeof(*desc), pkt_data_len);
        if (rx_align == WLCORE_RX_BUF_PADDED)
                skb_pull(skb, NET_IP_ALIGN);
 
                     beacon ? "beacon" : "",
                     seq_num, *hlid);
 
-       skb_trim(skb, skb->len - desc->pad_len);
-
        skb_queue_tail(&wl->deferred_rx_queue, skb);
        queue_work(wl->freezable_wq, &wl->netstack_work);
 
 
 /* forward declaration */
 struct wl1271_tx_hw_descr;
 enum wl_rx_buf_align;
+
 struct wlcore_ops {
        int (*identify_chip)(struct wl1271 *wl);
        int (*boot)(struct wl1271 *wl);
        enum wl_rx_buf_align (*get_rx_buf_align)(struct wl1271 *wl,
                                                 u32 rx_desc);
        void (*prepare_read)(struct wl1271 *wl, u32 rx_desc, u32 len);
+       u32 (*get_rx_packet_len)(struct wl1271 *wl, void *rx_data,
+                                u32 data_len);
        s8 (*get_pg_ver)(struct wl1271 *wl);
        void (*get_mac)(struct wl1271 *wl);
 };