The hardware may report a packet longer than our receive buffer. Instead
of reading past the read buffer, discard too long packets.
Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
---
drivers/net/smc911x.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index 767d51761b..4b2bd79392 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -460,13 +460,18 @@ static int smc911x_eth_rx(struct eth_device *edev)
smc911x_reg_write(priv, RX_CFG, 0);
tmplen = (pktlen + 2 + 3) / 4;
- while(tmplen--)
- *data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
+ if (tmplen <= PKTSIZE / sizeof(u32)) {
+ while (tmplen--)
+ *data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
+ } else {
+ while (tmplen--)
+ smc911x_reg_read(priv, RX_DATA_FIFO);
+ }
if(status & RX_STS_ES)
dev_err(&edev->dev, "dropped bad packet. Status: 0x%08x\n",
status);
- else
+ else if (tmplen <= PKTSIZE / sizeof(u32))
net_receive(edev, priv->rx_buf, pktlen);
}
--
2.39.2
