diff mbox

[RFC] asix: drop rx skb if header length is invalid

Message ID 1309296091-31476-1-git-send-email-maksim.rayskiy@gmail.com
State RFC, archived
Delegated to: David Miller
Headers show

Commit Message

maksim.rayskiy@gmail.com June 28, 2011, 9:21 p.m. UTC 
From: Maksim Rayskiy <mrayskiy@broadcom.com>

Signed-off-by: Maksim Rayskiy <mrayskiy@broadcom.com>
---

I am using AX88772 usbnet dongle, and sometimes after system resume I am seeing 
corrupt rx packets which generate infinite number of 
asix_rx_fixup() Bad Header Length
messages.
Looking at asix_rx_fixup() I see that depending on what junk you get in skb you
may end up with never breaking the while loop. Would not it be safer to bail out
as soon as incorrect header length was detected?

 drivers/net/usb/asix.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
diff mbox

Patch

diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 6998aa6..9d7a6ec 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -317,6 +317,7 @@  static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 		if ((short)(header & 0x0000ffff) !=
 		    ~((short)((header & 0xffff0000) >> 16))) {
 			netdev_err(dev->net, "asix_rx_fixup() Bad Header Length\n");
+			return 0;
 		}
 		/* get the packet length */
 		size = (u16) (header & 0x0000ffff);