]> git.baikalelectronics.ru Git - kernel.git/commit
net: xilinx_emaclite: fix receive buffer overflow
authorAnssi Hannula <anssi.hannula@bitwise.fi>
Tue, 14 Feb 2017 17:11:44 +0000 (19:11 +0200)
committerDavid S. Miller <davem@davemloft.net>
Wed, 15 Feb 2017 17:18:33 +0000 (12:18 -0500)
commitae761737cc9c6f0e858f3bc7e698f13898b4c76b
treee0c82bf644515f25f6a4f1e612b706ca7388dc76
parent956d74556ab2518065e464a0b341f4fb3f61bf2b
net: xilinx_emaclite: fix receive buffer overflow

xilinx_emaclite looks at the received data to try to determine the
Ethernet packet length but does not properly clamp it if
proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer
overflow and a panic via skb_panic() as the length exceeds the allocated
skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Fixes: aae0199b4648 ("net: add Xilinx emac lite device driver")
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/xilinx/xilinx_emaclite.c