Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d6fb3be5 authored by Rob Herring's avatar Rob Herring Committed by David S. Miller
Browse files

net: calxedaxgmac: throw away overrun frames 



The xgmac driver assumes 1 frame per descriptor. If a frame larger than
the descriptor's buffer size is received, the frame will spill over into
the next descriptor. So check for received frames that span more than one
descriptor and discard them. This prevents a crash if we receive erroneous
large packets.

Signed-off-by: default avatarRob Herring <rob.herring@calxeda.com>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2f94aabd

drivers/net/ethernet/calxeda/xgmac.c

+4 −0
Original line number Diff line number Diff line
@@ -548,6 +548,10 @@ static int desc_get_rx_status(struct xgmac_priv *priv, struct xgmac_dma_desc *p) 
		return -1;

	}



	/* All frames should fit into a single buffer */

	if (!(status & RXDESC_FIRST_SEG) || !(status & RXDESC_LAST_SEG))

		return -1;



	/* Check if packet has checksum already */

	if ((status & RXDESC_FRAME_TYPE) && (status & RXDESC_EXT_STATUS) &&

		!(ext_status & RXDESC_IP_PAYLOAD_MASK))