net: xilinx_emaclite: fix receive buffer overflow
authorAnssi Hannula <anssi.hannula@bitwise.fi>
Tue, 14 Feb 2017 17:11:44 +0000 (19:11 +0200)
committerDanny Wood <danwood76@gmail.com>
Tue, 29 Jan 2019 13:18:27 +0000 (13:18 +0000)
commit03c47d84376473a8629b0c6961b45a5d2f2b13ea
treed76b6ff659f1ed785d5827f9bc221b315a407789
parent5cca862c255c51b02ca9ce04610cef23bd2be960
net: xilinx_emaclite: fix receive buffer overflow

commit cd224553641848dd17800fe559e4ff5d208553e8 upstream.

xilinx_emaclite looks at the received data to try to determine the
Ethernet packet length but does not properly clamp it if
proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer
overflow and a panic via skb_panic() as the length exceeds the allocated
skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/net/ethernet/xilinx/xilinx_emaclite.c