diff options
| author | Otavio Salvador <otavio@ossystems.com.br> | 2020-05-20 08:43:03 -0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-05-20 08:43:03 -0300 |
| commit | 1279cd128bba968ebe0a2df7f7ae38bae90250ef (patch) | |
| tree | df6b1a190760f51465122ca4c13492d5ac5984c6 /drivers/staging/most/aim-network/networking.c | |
| parent | 0a8ab17689e628c84a666195bfc6ab85d11cf057 (diff) | |
| parent | 2ae782ca839e0ee07de37122ddea362adff2e975 (diff) | |
Merge pull request #76 from toradex/4.9-2.3.x-imx
4.9 2.3.x imx
Diffstat (limited to 'drivers/staging/most/aim-network/networking.c')
| -rw-r--r-- | drivers/staging/most/aim-network/networking.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/staging/most/aim-network/networking.c b/drivers/staging/most/aim-network/networking.c index 4659a6450c04..6b18afb62145 100644 --- a/drivers/staging/most/aim-network/networking.c +++ b/drivers/staging/most/aim-network/networking.c @@ -87,6 +87,11 @@ static int skb_to_mamac(const struct sk_buff *skb, struct mbo *mbo) unsigned int payload_len = skb->len - ETH_HLEN; unsigned int mdp_len = payload_len + MDP_HDR_LEN; + if (mdp_len < skb->len) { + pr_err("drop: too large packet! (%u)\n", skb->len); + return -EINVAL; + } + if (mbo->buffer_length < mdp_len) { pr_err("drop: too small buffer! (%d for %d)\n", mbo->buffer_length, mdp_len); @@ -134,6 +139,11 @@ static int skb_to_mep(const struct sk_buff *skb, struct mbo *mbo) u8 *buff = mbo->virt_address; unsigned int mep_len = skb->len + MEP_HDR_LEN; + if (mep_len < skb->len) { + pr_err("drop: too large packet! (%u)\n", skb->len); + return -EINVAL; + } + if (mbo->buffer_length < mep_len) { pr_err("drop: too small buffer! (%d for %d)\n", mbo->buffer_length, mep_len); |