summaryrefslogtreecommitdiff
path: root/drivers/net/ethernet/calxeda
diff options
context:
space:
mode:
authorRob Herring <rob.herring@calxeda.com>2013-01-16 17:36:37 +0400
committerDavid S. Miller <davem@davemloft.net>2013-01-18 23:14:52 +0400
commitd6fb3be544b46a7611a3373fcaa62b5b0be01888 (patch)
tree5e053611bbc52fd1f00686d0ad6a11a607b7aa25 /drivers/net/ethernet/calxeda
parent2f94aabd9f6c925d77aecb3ff020f1cc12ed8f86 (diff)
downloadlinux-d6fb3be544b46a7611a3373fcaa62b5b0be01888.tar.xz
net: calxedaxgmac: throw away overrun frames
The xgmac driver assumes 1 frame per descriptor. If a frame larger than the descriptor's buffer size is received, the frame will spill over into the next descriptor. So check for received frames that span more than one descriptor and discard them. This prevents a crash if we receive erroneous large packets. Signed-off-by: Rob Herring <rob.herring@calxeda.com> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/calxeda')
-rw-r--r--drivers/net/ethernet/calxeda/xgmac.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index b407043ce9b0..f7f02900f650 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -548,6 +548,10 @@ static int desc_get_rx_status(struct xgmac_priv *priv, struct xgmac_dma_desc *p)
return -1;
}
+ /* All frames should fit into a single buffer */
+ if (!(status & RXDESC_FIRST_SEG) || !(status & RXDESC_LAST_SEG))
+ return -1;
+
/* Check if packet has checksum already */
if ((status & RXDESC_FRAME_TYPE) && (status & RXDESC_EXT_STATUS) &&
!(ext_status & RXDESC_IP_PAYLOAD_MASK))