target/linux/generic/patches-3.19/775-bgmac-check-length-of-received-frame.patch

   1 From 2d12a9abf3f81de5b51852e3cfcba8cedac82642 Mon Sep 17 00:00:00 2001
   2 From: Hauke Mehrtens <hauke@hauke-m.de>
   3 Date: Fri, 6 Dec 2013 01:14:52 +0100
   4 Subject: [PATCH] bgmac: check length of received frame
   5
   6 ---
   7  drivers/net/ethernet/broadcom/bgmac.c |    9 ++++++++-
   8  1 file changed, 8 insertions(+), 1 deletion(-)
   9
  10 --- a/drivers/net/ethernet/broadcom/bgmac.c
  11 +++ b/drivers/net/ethernet/broadcom/bgmac.c
  12 @@ -361,6 +361,27 @@ static int bgmac_dma_rx_read(struct bgma
  13                         dma_addr_t old_dma_addr = slot->dma_addr;
  14                         int err;
  15
  16 +                       if (len > BGMAC_RX_MAX_FRAME_SIZE) {
  17 +                               struct bgmac_dma_desc *dma_desc = ring->cpu_base + ring->start;
  18 +
  19 +                               bgmac_err(bgmac, "Hardware reported invalid packet length %d for slot %d!\n", len, ring->start);
  20 +                               bgmac_err(bgmac, "flags: 0x%04X\n", flags);
  21 +                               bgmac_err(bgmac, "ctl0: 0x%08X\tctl1: 0x%08X\n", le32_to_cpu(dma_desc->ctl0), le32_to_cpu(dma_desc->ctl1));
  22 +
  23 +                               bgmac_err(bgmac, "   BGMAC_DMA_RX_CTL: 0x%08X\n", bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_CTL));
  24 +                               bgmac_err(bgmac, " BGMAC_DMA_RX_INDEX: 0x%08X\n", bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_INDEX));
  25 +                               bgmac_err(bgmac, "BGMAC_DMA_RX_RINGLO: 0x%08X\n", bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_RINGLO));
  26 +                               bgmac_err(bgmac, "BGMAC_DMA_RX_RINGHI: 0x%08X\n", bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_RINGHI));
  27 +                               bgmac_err(bgmac, "BGMAC_DMA_RX_STATUS: 0x%08X\n", bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_STATUS));
  28 +                               bgmac_err(bgmac, " BGMAC_DMA_RX_ERROR: 0x%08X\n", bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_ERROR));
  29 +
  30 +                               dma_sync_single_for_device(dma_dev,
  31 +                                                          slot->dma_addr,
  32 +                                                          BGMAC_RX_BUF_SIZE,
  33 +                                                          DMA_FROM_DEVICE);
  34 +                               break;
  35 +                       }
  36 +
  37                         /* Check for poison and drop or pass the packet */
  38                         if (len == 0xdead && flags == 0xbeef) {
  39                                 bgmac_err(bgmac, "Found poisoned packet at slot %d, DMA issue!\n",