From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Thu, 1 Oct 2009 15:19:16 +0000 (-0700)
Subject: another .27 patch
X-Git-Tag: v2.6.27.36~23
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=48d640ae7cbd9d55f68fcc2e6ebbef3434755870;p=thirdparty%2Fkernel%2Fstable-queue.git

another .27 patch
---

diff --git a/queue-2.6.27/enc28j60-fix-rx-buffer-overflow.patch b/queue-2.6.27/enc28j60-fix-rx-buffer-overflow.patch
new file mode 100644
index 00000000000..2030962d6aa
--- /dev/null
+++ b/queue-2.6.27/enc28j60-fix-rx-buffer-overflow.patch
@@ -0,0 +1,42 @@
+From 22692018b93f0782cda5a843cecfffda1854eb8d Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Sun, 4 Jan 2009 16:23:01 -0800
+Subject: enc28j60: fix RX buffer overflow
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+commit 22692018b93f0782cda5a843cecfffda1854eb8d upstream.
+
+The enc28j60 driver doesn't check whether the length of the packet as reported
+by the hardware fits into the preallocated buffer. When stressed, the hardware
+may report insanely large packets even tough the "Receive OK" bit is set. Fix
+this.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/enc28j60.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/enc28j60.c
++++ b/drivers/net/enc28j60.c
+@@ -919,7 +919,7 @@ static void enc28j60_hw_rx(struct net_de
+ 	if (netif_msg_rx_status(priv))
+ 		enc28j60_dump_rsv(priv, __FUNCTION__, next_packet, len, rxstat);
+ 
+-	if (!RSV_GETBIT(rxstat, RSV_RXOK)) {
++	if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) {
+ 		if (netif_msg_rx_err(priv))
+ 			dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat);
+ 		ndev->stats.rx_errors++;
+@@ -927,6 +927,8 @@ static void enc28j60_hw_rx(struct net_de
+ 			ndev->stats.rx_crc_errors++;
+ 		if (RSV_GETBIT(rxstat, RSV_LENCHECKERR))
+ 			ndev->stats.rx_frame_errors++;
++		if (len > MAX_FRAMELEN)
++			ndev->stats.rx_over_errors++;
+ 	} else {
+ 		skb = dev_alloc_skb(len + NET_IP_ALIGN);
+ 		if (!skb) {
diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index f74884716d8..4b10cceeffb 100644
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -1,2 +1,3 @@
 fs-make-sure-data-stored-into-inode-is-properly-seen-before-unlocking-new-inode.patch
 p54usb-add-zcomax-xg-705a-usbid.patch
+enc28j60-fix-rx-buffer-overflow.patch