mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: "Jules Maselbas" <jmaselbas@zdiv.net>
To: "Sascha Hauer" <s.hauer@pengutronix.de>,
	"Barebox List" <barebox@lists.infradead.org>
Cc: "jianqiang wang" <wjq.sec@gmail.com>
Subject: Re: [PATCH v2 5/7] net: smc911x: do not read past the receive buffer
Date: Mon, 27 May 2024 14:27:28 +0200	[thread overview]
Message-ID: <D1KFD2L4BTS3.1U2Q6YUGTPH8W@zdiv.net> (raw)
In-Reply-To: <20240527102723.3504270-6-s.hauer@pengutronix.de>

On Mon May 27, 2024 at 12:27 PM CEST, Sascha Hauer wrote:
> The hardware may report a packet longer than our receive buffer. Instead
> of reading past the read buffer, discard too long packets.
>
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  drivers/net/smc911x.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
> index 767d51761b..4b2bd79392 100644
> --- a/drivers/net/smc911x.c
> +++ b/drivers/net/smc911x.c
> @@ -460,13 +460,18 @@ static int smc911x_eth_rx(struct eth_device *edev)
>  		smc911x_reg_write(priv, RX_CFG, 0);
>  
>  		tmplen = (pktlen + 2 + 3) / 4;
> -		while(tmplen--)
> -			*data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
> +		if (tmplen <= PKTSIZE / sizeof(u32)) {
> +			while (tmplen--)
> +				*data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
> +		} else {
> +			while (tmplen--)
> +				smc911x_reg_read(priv, RX_DATA_FIFO);
> +		}
>  
>  		if(status & RX_STS_ES)
>  			dev_err(&edev->dev, "dropped bad packet. Status: 0x%08x\n",
>  				status);
> -		else
> +		else if (tmplen <= PKTSIZE / sizeof(u32))
tmplen here is zero, because it is used as a loop counter.

>  			net_receive(edev, priv->rx_buf, pktlen);
>  	}
>  




  reply	other threads:[~2024-05-27 12:28 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-05-27 10:27 [PATCH v2 0/7] net: do not read past " Sascha Hauer
2024-05-27 10:27 ` [PATCH v2 1/7] net: cs8900: simplify buffer read loop Sascha Hauer
2024-05-27 10:27 ` [PATCH v2 2/7] net: cs8900: do not read past the receive buffer Sascha Hauer
2024-05-27 10:27 ` [PATCH v2 3/7] net: ks8851_mll: " Sascha Hauer
2024-05-27 10:27 ` [PATCH v2 4/7] net: liteeth: " Sascha Hauer
2024-05-27 12:29   ` Jules Maselbas
2024-05-27 10:27 ` [PATCH v2 5/7] net: smc911x: " Sascha Hauer
2024-05-27 12:27   ` Jules Maselbas [this message]
2024-05-27 10:27 ` [PATCH v2 6/7] net: ks8851_mll: drop return value from ks8851_rx_frame() Sascha Hauer
2024-05-27 10:27 ` [PATCH v2 7/7] net: let net rx hook return void Sascha Hauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=D1KFD2L4BTS3.1U2Q6YUGTPH8W@zdiv.net \
    --to=jmaselbas@zdiv.net \
    --cc=barebox@lists.infradead.org \
    --cc=s.hauer@pengutronix.de \
    --cc=wjq.sec@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox