On Mon May 27, 2024 at 12:27 PM CEST, Sascha Hauer wrote:
> The hardware may report a packet longer than our receive buffer. Instead
> of reading past the read buffer, discard too long packets.
>
> Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
> ---
> drivers/net/smc911x.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
> index 767d51761b..4b2bd79392 100644
> --- a/drivers/net/smc911x.c
> +++ b/drivers/net/smc911x.c
> @@ -460,13 +460,18 @@ static int smc911x_eth_rx(struct eth_device *edev)
> smc911x_reg_write(priv, RX_CFG, 0);
>
> tmplen = (pktlen + 2 + 3) / 4;
> - while(tmplen--)
> - *data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
> + if (tmplen <= PKTSIZE / sizeof(u32)) {
> + while (tmplen--)
> + *data++ = smc911x_reg_read(priv, RX_DATA_FIFO);
> + } else {
> + while (tmplen--)
> + smc911x_reg_read(priv, RX_DATA_FIFO);
> + }
>
> if(status & RX_STS_ES)
> dev_err(&edev->dev, "dropped bad packet. Status: 0x%08x\n",
> status);
> - else
> + else if (tmplen <= PKTSIZE / sizeof(u32))
tmplen here is zero, because it is used as a loop counter.
> net_receive(edev, priv->rx_buf, pktlen);
> }
>
