hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c
kernel/drivers/net/usb/smsc75xx.c
....@@ -90,7 +90,9 @@
9090 ret = fn(dev, USB_VENDOR_REQUEST_READ_REGISTER, USB_DIR_IN
9191 | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
9292 0, index, &buf, 4);
93
- if (unlikely(ret < 0)) {
93
+ if (unlikely(ret < 4)) {
94
+ ret = ret < 0 ? ret : -ENODATA;
95
+
9496 netdev_warn(dev->net, "Failed to read reg index 0x%08x: %d\n",
9597 index, ret);
9698 return ret;
....@@ -2199,6 +2201,13 @@
21992201 size = (rx_cmd_a & RX_CMD_A_LEN) - RXW_PADDING;
22002202 align_count = (4 - ((size + RXW_PADDING) % 4)) % 4;
22012203
2204
+ if (unlikely(size > skb->len)) {
2205
+ netif_dbg(dev, rx_err, dev->net,
2206
+ "size err rx_cmd_a=0x%08x\n",
2207
+ rx_cmd_a);
2208
+ return 0;
2209
+ }
2210
+
22022211 if (unlikely(rx_cmd_a & RX_CMD_A_RED)) {
22032212 netif_dbg(dev, rx_err, dev->net,
22042213 "Error rx_cmd_a=0x%08x\n", rx_cmd_a);