From 22692018b93f0782cda5a843cecfffda1854eb8d Mon Sep 17 00:00:00 2001 From: Baruch Siach Date: Sun, 4 Jan 2009 16:23:01 -0800 Subject: enc28j60: fix RX buffer overflow The enc28j60 driver doesn't check whether the length of the packet as reported by the hardware fits into the preallocated buffer. When stressed, the hardware may report insanely large packets even tough the "Receive OK" bit is set. Fix this. Signed-off-by: Baruch Siach Signed-off-by: David S. Miller --- drivers/net/enc28j60.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers/net') diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c index b0ef46c51a9d..cefe1d98f93e 100644 --- a/drivers/net/enc28j60.c +++ b/drivers/net/enc28j60.c @@ -944,7 +944,7 @@ static void enc28j60_hw_rx(struct net_device *ndev) if (netif_msg_rx_status(priv)) enc28j60_dump_rsv(priv, __func__, next_packet, len, rxstat); - if (!RSV_GETBIT(rxstat, RSV_RXOK)) { + if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) { if (netif_msg_rx_err(priv)) dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat); ndev->stats.rx_errors++; @@ -952,6 +952,8 @@ static void enc28j60_hw_rx(struct net_device *ndev) ndev->stats.rx_crc_errors++; if (RSV_GETBIT(rxstat, RSV_LENCHECKERR)) ndev->stats.rx_frame_errors++; + if (len > MAX_FRAMELEN) + ndev->stats.rx_over_errors++; } else { skb = dev_alloc_skb(len + NET_IP_ALIGN); if (!skb) { -- cgit v1.2.3