[PATCH 1/2] net: usb: ax88179_178a: align rx_fixup with upstream

[Stefan Kerkmann]

This aligns the ax88179_rx_fixup path with the latest linux upstream
version 61997271a5a7d ("net: usb: asix: ax88772: Increase phy_name
size").

Signed-off-by: Stefan Kerkmann <s.kerkmann at pengutronix.de>
---
 drivers/net/usb/ax88179_178a.c | 73 +++++++++++++++++++++++++++++-------------
 1 file changed, 51 insertions(+), 22 deletions(-)

diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 0cf2635b77f86c9713dd5ed67d8ccf9bc30c45dd..78b5d943a4ecafab025ba3f8cc44293d16f31eb8 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -435,46 +435,75 @@ static void ax88179_unbind(struct usbnet *dev)
 
 static int ax88179_rx_fixup(struct usbnet *dev, void *buf, int len)
 {
-	int pkt_cnt, frame_pos;
-	u32 rx_hdr;
-	u16 hdr_off;
+	u16 hdr_off, pkt_len, pkt_len_plus_padd;
+	u32 rx_hdr, hdr;
+	u8 *pos = buf;
 	u32 *pkt_hdr;
+	int pkt_cnt;
 
 	if (len == dev->rx_urb_size) {
-		dev_err(&dev->udev->dev, "broken package\n");
+		dev_err(&dev->udev->dev, "%s: broken packet\n", __func__);
 		return 0;
 	}
 
-	rx_hdr = get_unaligned_le32(buf + len - 4);
+	if (len < sizeof(rx_hdr)) {
+		dev_err(&dev->udev->dev, "%s: short packet\n", __func__);
+		return 0;
+	}
+
+	rx_hdr = get_unaligned_le32(buf + len - sizeof(rx_hdr));
+	pkt_cnt = lower_16_bits(rx_hdr);
+	hdr_off = upper_16_bits(rx_hdr);
+
+	if (pkt_cnt == 0)
+		return 0;
+
+	if ((pkt_cnt * sizeof(*pkt_hdr) + hdr_off) > (len - sizeof(rx_hdr))) {
+		dev_err(&dev->udev->dev,
+			"%s: malformed metadata: pkt_cnt: %d hdr_off: %d len: %d\n",
+			__func__, pkt_cnt, hdr_off, len);
+		return 0;
+	}
 
-	pkt_cnt = (u16)rx_hdr;
-	hdr_off = (u16)(rx_hdr >> 16);
 	pkt_hdr = (u32 *)(buf + hdr_off);
 
-	frame_pos = 0;
+	/* Packets must not overlap the metadata array */
+	len = hdr_off;
 
-	while (pkt_cnt--) {
-		u16 pkt_len;
-		u32 hdr = le32_to_cpup(pkt_hdr);
+	for (; pkt_cnt > 0; pkt_cnt--, pkt_hdr++) {
+		hdr = le32_to_cpup(pkt_hdr);
+		pkt_len = upper_16_bits(hdr) & GENMASK(12, 0);
+		pkt_len_plus_padd = (pkt_len + 7) & GENMASK(15, 3);
 
-		pkt_len = (hdr >> 16) & 0x1fff;
+		/* Skip dummy header used for alignment */
+		if (pkt_len == 0)
+			continue;
+
+		if (pkt_len_plus_padd > len) {
+			dev_dbg(&dev->udev->dev,
+				"%s: packet too large: %d > %d\n", __func__,
+				pkt_len_plus_padd, len);
+			return 0;
+		}
 
 		/* Check CRC or runt packet */
-		if ((hdr & AX_RXHDR_CRC_ERR) ||
-		    (hdr & AX_RXHDR_DROP_ERR)) {
-			pkt_hdr++;
+		if ((hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) ||
+		    pkt_len < sizeof(u16) + ETH_HLEN) {
+			dev_dbg(&dev->udev->dev,
+				"%s: dropping packet: hdr: 0x%08x len: %d\n",
+				__func__, hdr, pkt_len);
+			pos += pkt_len_plus_padd;
+			len -= pkt_len_plus_padd;
 			continue;
 		}
 
-		frame_pos += 2;
+		dev_dbg(&dev->udev->dev, "%s: loop: frame_pos: %td len: %d\n",
+			__func__, pos - (u8 *)buf, pkt_len);
 
-		dev_dbg(&dev->udev->dev, "%s: loop: frame_pos: %d len: %d\n",
-			__func__, frame_pos, pkt_len);
+		net_receive(&dev->edev, pos + sizeof(u16), pkt_len);
 
-		net_receive(&dev->edev, buf + frame_pos, pkt_len);
-
-		pkt_hdr++;
-		frame_pos += ((pkt_len + 7) & 0xfff8) - 2;
+		pos += pkt_len_plus_padd;
+		len -= pkt_len_plus_padd;
 	}
 
 	return 0;

-- 
2.39.5