target/linux/generic/patches-3.10/775-bgmac-check-length-of-received-frame.patch

   1 From 2d12a9abf3f81de5b51852e3cfcba8cedac82642 Mon Sep 17 00:00:00 2001
   2 From: Hauke Mehrtens <hauke@hauke-m.de>
   3 Date: Fri, 6 Dec 2013 01:14:52 +0100
   4 Subject: [PATCH] bgmac: check length of received frame
   5
   6 ---
   7  drivers/net/ethernet/broadcom/bgmac.c |    9 ++++++++-
   8  1 file changed, 8 insertions(+), 1 deletion(-)
   9
  10 --- a/drivers/net/ethernet/broadcom/bgmac.c
  11 +++ b/drivers/net/ethernet/broadcom/bgmac.c
  12 @@ -347,6 +347,7 @@ static int bgmac_dma_rx_read(struct bgma
  13                 struct sk_buff *skb = slot->skb;
  14                 struct bgmac_rx_header *rx;
  15                 u16 len, flags;
  16 +               int count;
  17
  18                 /* Unmap buffer to make it accessible to the CPU */
  19                 dma_sync_single_for_cpu(dma_dev, slot->dma_addr,
  20 @@ -355,6 +356,12 @@ static int bgmac_dma_rx_read(struct bgma
  21                 /* Get info from the header */
  22                 rx = (struct bgmac_rx_header *)skb->data;
  23                 len = le16_to_cpu(rx->len);
  24 +               for (count = 0; count < 200; count++) {
  25 +                       len = le16_to_cpu(rx->len);
  26 +                       if (len)
  27 +                               break;
  28 +                       udelay(1);
  29 +               }
  30                 flags = le16_to_cpu(rx->flags);
  31
  32                 do {
  33 @@ -362,7 +369,7 @@ static int bgmac_dma_rx_read(struct bgma
  34                         int err;
  35
  36                         /* Check for poison and drop or pass the packet */
  37 -                       if (len == 0xdead && flags == 0xbeef) {
  38 +                       if (!len || (len == 0xdead && flags == 0xbeef)) {
  39                                 bgmac_err(bgmac, "Found poisoned packet at slot %d, DMA issue!\n",
  40                                           ring->start);
  41                                 dma_sync_single_for_device(dma_dev,