diff options
author | Ian Coolidge <iancoolidge@gmail.com> | 2012-11-06 16:00:10 -0500 |
---|---|---|
committer | Felipe Balbi <balbi@ti.com> | 2012-11-08 09:04:50 -0500 |
commit | 23834e533184bd2185bce500c789f86b3668739b (patch) | |
tree | 149f705a0ce8460e24b247e8f9e4359dc6cf2e63 /drivers/usb/gadget/u_ether.c | |
parent | be44f1c80b998b00cfa1759f4ba88f6497810963 (diff) |
usb: gadget: g_ether: fix frame size check
Checking skb->len against ETH_FRAME_LEN assumes a 1514
ethernet frame size. With an 802.1Q VLAN header, ethernet
frame length can now be 1518. Validate frame length against that.
Signed-off-by: Ian Coolidge <iancoolidge@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'drivers/usb/gadget/u_ether.c')
-rw-r--r-- | drivers/usb/gadget/u_ether.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c index 6458764994ef..4ec3c0d7a18b 100644 --- a/drivers/usb/gadget/u_ether.c +++ b/drivers/usb/gadget/u_ether.c | |||
@@ -20,6 +20,7 @@ | |||
20 | #include <linux/ctype.h> | 20 | #include <linux/ctype.h> |
21 | #include <linux/etherdevice.h> | 21 | #include <linux/etherdevice.h> |
22 | #include <linux/ethtool.h> | 22 | #include <linux/ethtool.h> |
23 | #include <linux/if_vlan.h> | ||
23 | 24 | ||
24 | #include "u_ether.h" | 25 | #include "u_ether.h" |
25 | 26 | ||
@@ -295,7 +296,7 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req) | |||
295 | while (skb2) { | 296 | while (skb2) { |
296 | if (status < 0 | 297 | if (status < 0 |
297 | || ETH_HLEN > skb2->len | 298 | || ETH_HLEN > skb2->len |
298 | || skb2->len > ETH_FRAME_LEN) { | 299 | || skb2->len > VLAN_ETH_FRAME_LEN) { |
299 | dev->net->stats.rx_errors++; | 300 | dev->net->stats.rx_errors++; |
300 | dev->net->stats.rx_length_errors++; | 301 | dev->net->stats.rx_length_errors++; |
301 | DBG(dev, "rx length %d\n", skb2->len); | 302 | DBG(dev, "rx length %d\n", skb2->len); |