.. | .. |
---|
90 | 90 | ret = fn(dev, USB_VENDOR_REQUEST_READ_REGISTER, USB_DIR_IN |
---|
91 | 91 | | USB_TYPE_VENDOR | USB_RECIP_DEVICE, |
---|
92 | 92 | 0, index, &buf, 4); |
---|
93 | | - if (unlikely(ret < 0)) { |
---|
| 93 | + if (unlikely(ret < 4)) { |
---|
| 94 | + ret = ret < 0 ? ret : -ENODATA; |
---|
| 95 | + |
---|
94 | 96 | netdev_warn(dev->net, "Failed to read reg index 0x%08x: %d\n", |
---|
95 | 97 | index, ret); |
---|
96 | 98 | return ret; |
---|
.. | .. |
---|
2199 | 2201 | size = (rx_cmd_a & RX_CMD_A_LEN) - RXW_PADDING; |
---|
2200 | 2202 | align_count = (4 - ((size + RXW_PADDING) % 4)) % 4; |
---|
2201 | 2203 | |
---|
| 2204 | + if (unlikely(size > skb->len)) { |
---|
| 2205 | + netif_dbg(dev, rx_err, dev->net, |
---|
| 2206 | + "size err rx_cmd_a=0x%08x\n", |
---|
| 2207 | + rx_cmd_a); |
---|
| 2208 | + return 0; |
---|
| 2209 | + } |
---|
| 2210 | + |
---|
2202 | 2211 | if (unlikely(rx_cmd_a & RX_CMD_A_RED)) { |
---|
2203 | 2212 | netif_dbg(dev, rx_err, dev->net, |
---|
2204 | 2213 | "Error rx_cmd_a=0x%08x\n", rx_cmd_a); |
---|