Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22692018 authored by Baruch Siach's avatar Baruch Siach Committed by David S. Miller
Browse files

enc28j60: fix RX buffer overflow 



The enc28j60 driver doesn't check whether the length of the packet as reported 
by the hardware fits into the preallocated buffer. When stressed, the hardware 
may report insanely large packets even tough the "Receive OK" bit is set. Fix 
this.

Signed-off-by: default avatarBaruch Siach <baruch@tkos.co.il>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fecc7036

drivers/net/enc28j60.c

+3 −1
Original line number Diff line number Diff line
@@ -944,7 +944,7 @@ static void enc28j60_hw_rx(struct net_device *ndev) 
	if (netif_msg_rx_status(priv))

		enc28j60_dump_rsv(priv, __func__, next_packet, len, rxstat);



	if (!RSV_GETBIT(rxstat, RSV_RXOK)) {

	if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) {

		if (netif_msg_rx_err(priv))

			dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat);

		ndev->stats.rx_errors++;
@@ -952,6 +952,8 @@ static void enc28j60_hw_rx(struct net_device *ndev) 
			ndev->stats.rx_crc_errors++;

		if (RSV_GETBIT(rxstat, RSV_LENCHECKERR))

			ndev->stats.rx_frame_errors++;

		if (len > MAX_FRAMELEN)

			ndev->stats.rx_over_errors++;

	} else {

		skb = dev_alloc_skb(len + NET_IP_ALIGN);

		if (!skb) {