[PATCH v2 5/7] net: smc911x: do not read past the receive buffer

[Jules Maselbas]

On Mon May 27, 2024 at 12:27 PM CEST, Sascha Hauer wrote:
> The hardware may report a packet longer than our receive buffer. Instead
> of reading past the read buffer, discard too long packets.
>
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> ---
>  drivers/net/smc911x.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
> index 767d51761b..4b2bd79392 100644
> --- a/drivers/net/smc911x.c
> +++ b/drivers/net/smc911x.c
> @@ -460,13 +460,18 @@ static int smc911x_eth_rx(struct eth_device *edev)
>  		smc911x_reg_write(priv, RX_CFG, 0);
>  
>  		tmplen = (pktlen + 2 + 3) / 4;
> -		while(tmplen--)
> -			*data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
> +		if (tmplen <= PKTSIZE / sizeof(u32)) {
> +			while (tmplen--)
> +				*data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
> +		} else {
> +			while (tmplen--)
> +				smc911x_reg_read(priv, RX_DATA_FIFO);
> +		}
>  
>  		if(status & RX_STS_ES)
>  			dev_err(&edev->dev, "dropped bad packet. Status: 0x%08x\n",
>  				status);
> -		else
> +		else if (tmplen <= PKTSIZE / sizeof(u32))
tmplen here is zero, because it is used as a loop counter.

>  			net_receive(edev, priv->rx_buf, pktlen);
>  	}
>