net: xilinx_emaclite: fix receive buffer overflow
authorAnssi Hannula <anssi.hannula@bitwise.fi>
Tue, 14 Feb 2017 17:11:44 +0000 (19:11 +0200)
committerWilly Tarreau <w@1wt.eu>
Thu, 2 Nov 2017 06:16:26 +0000 (07:16 +0100)
commitf6b525b94bda339cf0064e2561fc7e7747bb46a8
treeacd7185f4e6fcc93867641b6e525d1fcbff3660f
parent7e25c935ec7b43c088d21b9c8e4a6b970375d933
net: xilinx_emaclite: fix receive buffer overflow

commit cd224553641848dd17800fe559e4ff5d208553e8 upstream.

xilinx_emaclite looks at the received data to try to determine the
Ethernet packet length but does not properly clamp it if
proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer
overflow and a panic via skb_panic() as the length exceeds the allocated
skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/net/ethernet/xilinx/xilinx_emaclite.c