[PATCH 2/5] net: cs8900: do not read past the receive buffer

[Sascha Hauer]

Hi Jules,

On Mon, May 27, 2024 at 10:58:55AM +0200, Jules Maselbas wrote:
> Hi Sascha,
> 
> Just a quick remark:
> 
> On Mon May 27, 2024 at 9:29 AM CEST, Sascha Hauer wrote:
> > the hardware may report a packet longer than our receive buffer. Instead
> > of reading past the read buffer, discard too long packets.
> >
> > Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> > ---
> >  drivers/net/cs8900.c | 9 +++++++--
> >  1 file changed, 7 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/net/cs8900.c b/drivers/net/cs8900.c
> > index afb0f3e26e..a96b574f95 100644
> > --- a/drivers/net/cs8900.c
> > +++ b/drivers/net/cs8900.c
> > @@ -295,8 +295,13 @@ static int cs8900_recv(struct eth_device *dev)
> >  	status = readw(priv->regs + CS8900_RTDATA0);
> >  	len = readw(priv->regs + CS8900_RTDATA0);
> >  
> > -	for (addr = (u16 *)priv->rx_buf, i = (len + 1) >> 1; i > 0; i--)
> > -		*addr++ = readw(priv->regs + CS8900_RTDATA0);
> > +	if (len <= PKTSIZE) {
> > +		for (addr = (u16 *)priv->rx_buf, i = (len + 1) >> 1; i > 0; i--)
> > +			*addr++ = readw(priv->regs + CS8900_RTDATA0);
> > +	} else {
> > +		for (addr = (u16 *)priv->rx_buf, i = (len + 1) >> 1; i > 0; i--)
> > +			(void)readw(priv->regs + CS8900_RTDATA0);
> So the packet is "discarded" here but the function doesn't returns with an error
> and proceed to call net_received with the previous (if any) packet but with the
> new length ...

Ouch, that was not intenden. Will fix.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |