Ticket #7198: 775-bgmac-check-length-of-received-frame.patch

File 775-bgmac-check-length-of-received-frame.patch, 1.3 KB (added by hauke, 4 years ago)
  • drivers/net/ethernet/broadcom/bgmac.c

    From 2d12a9abf3f81de5b51852e3cfcba8cedac82642 Mon Sep 17 00:00:00 2001
    From: Hauke Mehrtens <hauke@hauke-m.de>
    Date: Fri, 6 Dec 2013 01:14:52 +0100
    Subject: [PATCH] bgmac: check length of received frame
    
    ---
     drivers/net/ethernet/broadcom/bgmac.c |    9 ++++++++-
     1 file changed, 8 insertions(+), 1 deletion(-)
    
    a b static int bgmac_dma_rx_read(struct bgma 
    347347                struct sk_buff *skb = slot->skb; 
    348348                struct bgmac_rx_header *rx; 
    349349                u16 len, flags; 
     350                int count; 
    350351 
    351352                /* Unmap buffer to make it accessible to the CPU */ 
    352353                dma_sync_single_for_cpu(dma_dev, slot->dma_addr, 
    static int bgmac_dma_rx_read(struct bgma 
    355356                /* Get info from the header */ 
    356357                rx = (struct bgmac_rx_header *)skb->data; 
    357358                len = le16_to_cpu(rx->len); 
     359                for (count = 0; count < 200; count++) { 
     360                        len = le16_to_cpu(rx->len); 
     361                        if (len) 
     362                                break; 
     363                        udelay(1); 
     364                } 
    358365                flags = le16_to_cpu(rx->flags); 
    359366 
    360367                do { 
    static int bgmac_dma_rx_read(struct bgma 
    362369                        int err; 
    363370 
    364371                        /* Check for poison and drop or pass the packet */ 
    365                         if (len == 0xdead && flags == 0xbeef) { 
     372                        if (!len || (len == 0xdead && flags == 0xbeef)) { 
    366373                                bgmac_err(bgmac, "Found poisoned packet at slot %d, DMA issue!\n", 
    367374                                          ring->start); 
    368375                                dma_sync_single_for_device(dma_dev,