[PATCH 2/5] net: cs8900: do not read past the receive buffer

[Jules Maselbas]

Hi Sascha,

Just a quick remark:

On Mon May 27, 2024 at 9:29 AM CEST, Sascha Hauer wrote:
> the hardware may report a packet longer than our receive buffer. Instead
> of reading past the read buffer, discard too long packets.
>
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> ---
>  drivers/net/cs8900.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/cs8900.c b/drivers/net/cs8900.c
> index afb0f3e26e..a96b574f95 100644
> --- a/drivers/net/cs8900.c
> +++ b/drivers/net/cs8900.c
> @@ -295,8 +295,13 @@ static int cs8900_recv(struct eth_device *dev)
>  	status = readw(priv->regs + CS8900_RTDATA0);
>  	len = readw(priv->regs + CS8900_RTDATA0);
>  
> -	for (addr = (u16 *)priv->rx_buf, i = (len + 1) >> 1; i > 0; i--)
> -		*addr++ = readw(priv->regs + CS8900_RTDATA0);
> +	if (len <= PKTSIZE) {
> +		for (addr = (u16 *)priv->rx_buf, i = (len + 1) >> 1; i > 0; i--)
> +			*addr++ = readw(priv->regs + CS8900_RTDATA0);
> +	} else {
> +		for (addr = (u16 *)priv->rx_buf, i = (len + 1) >> 1; i > 0; i--)
> +			(void)readw(priv->regs + CS8900_RTDATA0);
So the packet is "discarded" here but the function doesn't returns with an error
and proceed to call net_received with the previous (if any) packet but with the
new length ...

I am not sure if this is an issue or not.

> +	}
>  
>  	net_receive(dev, priv->rx_buf, len);
>  


best,
Jules