From patchwork Tue Nov 6 21:00:10 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Coolidge X-Patchwork-Id: 197542 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 7B9CE2C00DA for ; Wed, 7 Nov 2012 07:59:24 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752663Ab2KFU7W (ORCPT ); Tue, 6 Nov 2012 15:59:22 -0500 Received: from mail-pb0-f46.google.com ([209.85.160.46]:58457 "EHLO mail-pb0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751870Ab2KFU7V (ORCPT ); Tue, 6 Nov 2012 15:59:21 -0500 Received: by mail-pb0-f46.google.com with SMTP id rr4so677472pbb.19 for ; Tue, 06 Nov 2012 12:59:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; bh=4lSJwvoamHwcwkQTTY2hZolh7caJ7iNdWCnVmu1KhSU=; b=EtE0GyvMzAvbGndY6XJP8hNgn2wDxYiIREKyLeLCZlgPH+M7lnlLRaGEJaIWXb+Lu4 V1vdlIjjL62DvNaC+EH10VGJ486aCmU1Xd/4MNhTLvFAbDGUuXoBoZayHtz+VXXoyDtD j7AIt464Nyef5TVukG8R/gKX3IHQV/MCMe+WP2xAafJgj/x/ySnQZjo3YLfglQDXRF+n 2baQK9OCb8yg4IKmdksWqRBOUxut1k9sOXwqYXK4HszAywWeyTGJzqVJqVpjpLdeMjt7 V2O4orvXgepuYb/qK9LC4+j/km7MAXenm24lUyzclCRz1mS+UYoARtQwWWOzXc/b67Jy Y/VQ== Received: by 10.68.222.37 with SMTP id qj5mr6811897pbc.132.1352235560999; Tue, 06 Nov 2012 12:59:20 -0800 (PST) Received: from localhost.localdomain ([69.199.146.210]) by mx.google.com with ESMTPS id sf4sm12853909pbc.75.2012.11.06.12.59.19 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 06 Nov 2012 12:59:20 -0800 (PST) From: Ian Coolidge To: Oliver Neukum , Greg Kroah-Hartman , Felipe Balbi , linux-usb@vger.kernel.org, netdev@vger.kernel.org Cc: Ian Coolidge Subject: [PATCH 1/2] usb: gadget: g_ether: fix frame size check Date: Tue, 6 Nov 2012 13:00:10 -0800 Message-Id: <1352235611-13066-2-git-send-email-iancoolidge@gmail.com> X-Mailer: git-send-email 1.7.6.5 In-Reply-To: <1352235611-13066-1-git-send-email-iancoolidge@gmail.com> References: <1352235611-13066-1-git-send-email-iancoolidge@gmail.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Checking skb->len against ETH_FRAME_LEN assumes a 1514 ethernet frame size. With an 802.1Q VLAN header, ethernet frame length can now be 1518. Validate frame length against that. Signed-off-by: Ian Coolidge --- drivers/usb/gadget/u_ether.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c index 29c854b..ff2c70b 100644 --- a/drivers/usb/gadget/u_ether.c +++ b/drivers/usb/gadget/u_ether.c @@ -19,6 +19,7 @@ #include #include #include +#include #include "u_ether.h" @@ -301,7 +302,7 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req) while (skb2) { if (status < 0 || ETH_HLEN > skb2->len - || skb2->len > ETH_FRAME_LEN) { + || skb2->len > VLAN_ETH_FRAME_LEN) { dev->net->stats.rx_errors++; dev->net->stats.rx_length_errors++; DBG(dev, "rx length %d\n", skb2->len);