linux/drivers/net
hayeswang 7937f9e514 r8152: fix tx/rx memory overflow
The tx/rx would access the memory which is out of the desired range.
Modify the method of checking the end of the memory to avoid it.

For r8152_tx_agg_fill(), the variable remain may become negative.
However, the declaration is unsigned, so the while loop wouldn't
break when reaching the end of the desied memory. Although to change
the declaration from unsigned to signed is enough to fix it, I also
modify the checking method for safe. Replace

		remain = rx_buf_sz - sizeof(*tx_desc) -
			 (u32)((void *)tx_data - agg->head);

with

		remain = rx_buf_sz - (int)(tx_agg_align(tx_data) - agg->head);

to make sure the variable remain is always positive. Then, the
overflow wouldn't happen.

For rx_bottom(), the rx_desc should not be used to calculate the
packet length before making sure the rx_desc is in the desired range.
Change the checking to two parts. First, check the descriptor is in
the memory. The other, using the descriptor to find out the packet
length and check if the packet is in the memory.

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-11-20 15:09:41 -05:00
..
appletalk
arcnet
bonding bonding: add ip checks when store ip target 2013-11-15 17:44:43 -05:00
caif virtio: use size-based config accessors. 2013-10-17 10:55:37 +10:30
can Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-11-13 17:40:34 +09:00
cris
dsa
ethernet Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-19 15:50:47 -08:00
fddi net:drivers/net: Miscellaneous conversions to ETH_ALEN 2013-10-02 17:04:45 -04:00
hamradio Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-10-23 16:49:34 -04:00
hippi
hyperv
ieee802154 tree-wide: use reinit_completion instead of INIT_COMPLETION 2013-11-15 09:32:21 +09:00
irda Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-11-15 16:47:22 -08:00
phy Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-11-13 17:40:34 +09:00
plip net:drivers/net: Miscellaneous conversions to ETH_ALEN 2013-10-02 17:04:45 -04:00
ppp ip: generate unique IP identificator if local fragmentation is allowed 2013-09-19 14:11:15 -04:00
slip slip/slcan: added locking in wakeup function 2013-09-20 15:38:26 -04:00
team Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-19 15:50:47 -08:00
usb r8152: fix tx/rx memory overflow 2013-11-20 15:09:41 -05:00
vmxnet3 vmxnet3: Remove extern from function prototypes 2013-09-24 16:37:10 -07:00
wan Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-04 13:48:30 -05:00
wimax wimax: Remove extern from function prototypes 2013-09-24 16:46:22 -07:00
wireless Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-19 15:50:47 -08:00
xen-netback Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-04 13:48:30 -05:00
dummy.c net: Explicitly initialize u64_stats_sync structures for lockdep 2013-11-06 12:40:25 +01:00
eql.c
ifb.c net: Explicitly initialize u64_stats_sync structures for lockdep 2013-11-06 12:40:25 +01:00
Kconfig
LICENSE.SRC
loopback.c net: Explicitly initialize u64_stats_sync structures for lockdep 2013-11-06 12:40:25 +01:00
macvlan.c Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2013-11-14 16:30:30 +09:00
macvtap.c macvtap: limit head length of skb allocated 2013-11-14 16:05:27 -05:00
Makefile
mdio.c
mii.c
netconsole.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-04 13:48:30 -05:00
nlmon.c net: Explicitly initialize u64_stats_sync structures for lockdep 2013-11-06 12:40:25 +01:00
ntb_netdev.c
rionet.c
sb1000.c
Space.c net/ethernet: Drop H8/300 Ethernet driver 2013-09-16 18:20:24 -07:00
sungem_phy.c
tun.c tuntap: limit head length of skb allocated 2013-11-14 16:05:27 -05:00
veth.c Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2013-11-14 16:30:30 +09:00
virtio_net.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-19 15:50:47 -08:00
vxlan.c Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2013-11-14 16:30:30 +09:00
xen-netfront.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-19 15:50:47 -08:00