summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRob Herring <rob.herring@calxeda.com>2013-01-16 13:36:37 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-02-14 10:49:00 -0800
commitf0adabb18a751ecff5da1e03d47b13dd9628b89b (patch)
treeaea054d5d6ad580c79d2774a5a7b8f5403ed195a
parent07da6b22a219ba7907ad41118f0e77f4b8fae9a9 (diff)
net: calxedaxgmac: throw away overrun frames
[ Upstream commit d6fb3be544b46a7611a3373fcaa62b5b0be01888 ] The xgmac driver assumes 1 frame per descriptor. If a frame larger than the descriptor's buffer size is received, the frame will spill over into the next descriptor. So check for received frames that span more than one descriptor and discard them. This prevents a crash if we receive erroneous large packets. Signed-off-by: Rob Herring <rob.herring@calxeda.com> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/net/ethernet/calxeda/xgmac.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index 11f667f6131a..4ebbe6f609d0 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -547,6 +547,10 @@ static int desc_get_rx_status(struct xgmac_priv *priv, struct xgmac_dma_desc *p)
return -1;
}
+ /* All frames should fit into a single buffer */
+ if (!(status & RXDESC_FIRST_SEG) || !(status & RXDESC_LAST_SEG))
+ return -1;
+
/* Check if packet has checksum already */
if ((status & RXDESC_FRAME_TYPE) && (status & RXDESC_EXT_STATUS) &&
!(ext_status & RXDESC_IP_PAYLOAD_MASK))