diff options
author | Wolfram Sang <wsa@kernel.org> | 2023-04-24 13:50:20 +0300 |
---|---|---|
committer | Wolfram Sang <wsa@kernel.org> | 2023-04-24 13:50:20 +0300 |
commit | 38c87827ffd3c7e1dd61eee9a7dea13d487dc2ed (patch) | |
tree | e6bd1c3ae56823874a736c1512409c123c9a4219 /drivers/net/usb/lan78xx.c | |
parent | 9496fffcb28f39e0352779a0199b6e61861c9221 (diff) | |
parent | d663d93bb47e7ab45602b227701022d8aa16040a (diff) | |
download | linux-38c87827ffd3c7e1dd61eee9a7dea13d487dc2ed.tar.xz |
Merge branch 'i2c/for-current' into i2c/for-mergewindow
This should have been in 6.3, but sadly I missed it.
Diffstat (limited to 'drivers/net/usb/lan78xx.c')
-rw-r--r-- | drivers/net/usb/lan78xx.c | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index 068488890d57..c458c030fadf 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -3579,13 +3579,29 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb, size = (rx_cmd_a & RX_CMD_A_LEN_MASK_); align_count = (4 - ((size + RXW_PADDING) % 4)) % 4; + if (unlikely(size > skb->len)) { + netif_dbg(dev, rx_err, dev->net, + "size err rx_cmd_a=0x%08x\n", + rx_cmd_a); + return 0; + } + if (unlikely(rx_cmd_a & RX_CMD_A_RED_)) { netif_dbg(dev, rx_err, dev->net, "Error rx_cmd_a=0x%08x", rx_cmd_a); } else { - u32 frame_len = size - ETH_FCS_LEN; + u32 frame_len; struct sk_buff *skb2; + if (unlikely(size < ETH_FCS_LEN)) { + netif_dbg(dev, rx_err, dev->net, + "size err rx_cmd_a=0x%08x\n", + rx_cmd_a); + return 0; + } + + frame_len = size - ETH_FCS_LEN; + skb2 = napi_alloc_skb(&dev->napi, frame_len); if (!skb2) return 0; |