releases/2.6.27.36/enc28j60-fix-rx-buffer-overflow.patch

   1 From 22692018b93f0782cda5a843cecfffda1854eb8d Mon Sep 17 00:00:00 2001
   2 From: Baruch Siach <baruch@tkos.co.il>
   3 Date: Sun, 4 Jan 2009 16:23:01 -0800
   4 Subject: enc28j60: fix RX buffer overflow
   5
   6 From: Baruch Siach <baruch@tkos.co.il>
   7
   8 commit 22692018b93f0782cda5a843cecfffda1854eb8d upstream.
   9
  10 The enc28j60 driver doesn't check whether the length of the packet as reported
  11 by the hardware fits into the preallocated buffer. When stressed, the hardware
  12 may report insanely large packets even tough the "Receive OK" bit is set. Fix
  13 this.
  14
  15 Signed-off-by: Baruch Siach <baruch@tkos.co.il>
  16 Signed-off-by: David S. Miller <davem@davemloft.net>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  18
  19 ---
  20  drivers/net/enc28j60.c |    4 +++-
  21  1 file changed, 3 insertions(+), 1 deletion(-)
  22
  23 --- a/drivers/net/enc28j60.c
  24 +++ b/drivers/net/enc28j60.c
  25 @@ -919,7 +919,7 @@ static void enc28j60_hw_rx(struct net_de
  26         if (netif_msg_rx_status(priv))
  27                 enc28j60_dump_rsv(priv, __FUNCTION__, next_packet, len, rxstat);
  28
  29 -       if (!RSV_GETBIT(rxstat, RSV_RXOK)) {
  30 +       if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) {
  31                 if (netif_msg_rx_err(priv))
  32                         dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat);
  33                 ndev->stats.rx_errors++;
  34 @@ -927,6 +927,8 @@ static void enc28j60_hw_rx(struct net_de
  35                         ndev->stats.rx_crc_errors++;
  36                 if (RSV_GETBIT(rxstat, RSV_LENCHECKERR))
  37                         ndev->stats.rx_frame_errors++;
  38 +               if (len > MAX_FRAMELEN)
  39 +                       ndev->stats.rx_over_errors++;
  40         } else {
  41                 skb = dev_alloc_skb(len + NET_IP_ALIGN);
  42                 if (!skb) {