net: xilinx_emaclite: fix receive buffer overflow
authorAnssi Hannula <anssi.hannula@bitwise.fi>
Wed, 24 May 2017 01:53:29 +0000 (21:53 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 17 Jun 2017 04:39:35 +0000 (06:39 +0200)
commit10a7629772676694cb4da272df2b391f1963fc7d
treec1e046fc91ba5b27b8b82b3d7ab97ed5e7c1f4cb
parent7f71f22a116f6fa834577ca4e57b1c81f730e1e5
net: xilinx_emaclite: fix receive buffer overflow

[ Upstream commit cd224553641848dd17800fe559e4ff5d208553e8 ]

xilinx_emaclite looks at the received data to try to determine the
Ethernet packet length but does not properly clamp it if
proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer
overflow and a panic via skb_panic() as the length exceeds the allocated
skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/ethernet/xilinx/xilinx_emaclite.c