ctcm: avoid wraparound in length of incoming data

Since the receive code should tolerate any incoming garbage, it
should be protected against a potential wraparound when manipulating
length values within incoming data.
block_len is unsigned, so a too large subtraction will cause a
wraparound.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 3 deletions

diff --git a/drivers/s390/net/ctcm_fsms.c b/drivers/s390/net/ctcm_fsms.c
index f29c7086fc19..4ded9ac2c5ef 100644
--- a/drivers/s390/net/ctcm_fsms.c
+++ b/drivers/s390/net/ctcm_fsms.c
@@ -410,9 +410,8 @@ static void chx_rx(fsm_instance *fi, int event, void *arg)
                 priv->stats.rx_length_errors++;
                                                 goto again;
         }
-        block_len -= 2;
-        if (block_len > 0) {
-                *((__u16 *)skb->data) = block_len;
+        if (block_len > 2) {
+                *((__u16 *)skb->data) = block_len - 2;
                 ctcm_unpack_skb(ch, skb);
         }
  again: