enc28j60: fix RX buffer overflow

The enc28j60 driver doesn't check whether the length of the packet as reported 
by the hardware fits into the preallocated buffer. When stressed, the hardware 
may report insanely large packets even tough the "Receive OK" bit is set. Fix 
this.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 1 deletions

diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c
index b0ef46c51a9d..cefe1d98f93e 100644
--- a/drivers/net/enc28j60.c
+++ b/drivers/net/enc28j60.c
@@ -944,7 +944,7 @@ static void enc28j60_hw_rx(struct net_device *ndev)
         if (netif_msg_rx_status(priv))
                 enc28j60_dump_rsv(priv, __func__, next_packet, len, rxstat);
 
-        if (!RSV_GETBIT(rxstat, RSV_RXOK)) {
+        if (!RSV_GETBIT(rxstat, RSV_RXOK) || len > MAX_FRAMELEN) {
                 if (netif_msg_rx_err(priv))
                         dev_err(&ndev->dev, "Rx Error (%04x)\n", rxstat);
                 ndev->stats.rx_errors++;
@@ -952,6 +952,8 @@ static void enc28j60_hw_rx(struct net_device *ndev)
                         ndev->stats.rx_crc_errors++;
                 if (RSV_GETBIT(rxstat, RSV_LENCHECKERR))
                         ndev->stats.rx_frame_errors++;
+                if (len > MAX_FRAMELEN)
+                        ndev->stats.rx_over_errors++;
         } else {
                 skb = dev_alloc_skb(len + NET_IP_ALIGN);
                 if (!skb) {