summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBaruch Siach <baruch@tkos.co.il>2009-01-04 16:23:01 -0800
committerDavid S. Miller <davem@davemloft.net>2009-01-04 16:23:01 -0800
commit22692018b93f0782cda5a843cecfffda1854eb8d (patch)
treeb75537b4c063a28226d1810d0209b30375613eec
parentfecc7036e73a71231045e03ff524b5f8bd892a84 (diff)
downloadop-kernel-dev-22692018b93f0782cda5a843cecfffda1854eb8d.zip
op-kernel-dev-22692018b93f0782cda5a843cecfffda1854eb8d.tar.gz
enc28j60: fix RX buffer overflow
The enc28j60 driver doesn't check whether the length of the packet as reported by the hardware fits into the preallocated buffer. When stressed, the hardware may report insanely large packets even tough the "Receive OK" bit is set. Fix this. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/enc28j60.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c
index b0ef46c..cefe1d9 100644
--- a/drivers/net/enc28j60.c
+++ b/drivers/net/enc28j60.c
@@ -944,7 +944,7 @@ static void enc28j60_hw_rx(struct net_device *ndev)
if (netif_msg_rx_status(priv))
enc28j60_dump_rsv(priv, __func__, next_packet, len, rxstat);
- if (!RSV_GETBIT(rxstat, RSV_RXOK)) {
+ if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) {
if (netif_msg_rx_err(priv))
dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat);
ndev->stats.rx_errors++;
@@ -952,6 +952,8 @@ static void enc28j60_hw_rx(struct net_device *ndev)
ndev->stats.rx_crc_errors++;
if (RSV_GETBIT(rxstat, RSV_LENCHECKERR))
ndev->stats.rx_frame_errors++;
+ if (len > MAX_FRAMELEN)
+ ndev->stats.rx_over_errors++;
} else {
skb = dev_alloc_skb(len + NET_IP_ALIGN);
if (!skb) {
OpenPOWER on IntegriCloud