[PATCH v2 5/7] net: smc911x: do not read past the receive buffer

[Sascha Hauer]

The hardware may report a packet longer than our receive buffer. Instead
of reading past the read buffer, discard too long packets.

Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
---
 drivers/net/smc911x.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index 767d51761b..4b2bd79392 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -460,13 +460,18 @@ static int smc911x_eth_rx(struct eth_device *edev)
 		smc911x_reg_write(priv, RX_CFG, 0);
 
 		tmplen = (pktlen + 2 + 3) / 4;
-		while(tmplen--)
-			*data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
+		if (tmplen <= PKTSIZE / sizeof(u32)) {
+			while (tmplen--)
+				*data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
+		} else {
+			while (tmplen--)
+				smc911x_reg_read(priv, RX_DATA_FIFO);
+		}
 
 		if(status & RX_STS_ES)
 			dev_err(&edev->dev, "dropped bad packet. Status: 0x%08x\n",
 				status);
-		else
+		else if (tmplen <= PKTSIZE / sizeof(u32))
 			net_receive(edev, priv->rx_buf, pktlen);
 	}
 
-- 
2.39.2