net: xilinx_emaclite: fix receive buffer overflow
authorAnssi Hannula <anssi.hannula@bitwise.fi>
Wed, 24 May 2017 01:53:29 +0000 (21:53 -0400)
committerRaspbian kernel package updater <root@raspbian.org>
Sun, 23 Jul 2017 02:57:16 +0000 (02:57 +0000)
commitf4ac78ea0e96cf9ea3c5d6f1efb0d24ba08abfe6
tree2272320f30d50eda6501d56271f7b38947f94999
parent7b3c819eff418a60a30d0d8f6ddc6581e2d570f7
net: xilinx_emaclite: fix receive buffer overflow

[ Upstream commit cd224553641848dd17800fe559e4ff5d208553e8 ]

xilinx_emaclite looks at the received data to try to determine the
Ethernet packet length but does not properly clamp it if
proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer
overflow and a panic via skb_panic() as the length exceeds the allocated
skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/ethernet/xilinx/xilinx_emaclite.c