[linux-yocto] [PATCH 21/35] net: femac: Avoid panic in skb_put()

[Daniel Dragomir]

From: Anders Berg <anders.berg at avagotech.com>

On very rare occations the femac_rx_packet() will overrun the sk_buff causuing
skb_put() to panic. To current date, we have only had one reported case which
makes it hard to diagnose. This patch is not a proper solution, it is a step on
the way to get some more information on the real issue. To avoid painc from
skb_put(), we make sure there is tailroom in the skb before adding more data to
it, and emit an error log if the buffer was full.

Signed-off-by: Anders Berg <anders.berg at avagotech.com>
---
 drivers/net/ethernet/lsi/lsi_acp_net.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/lsi/lsi_acp_net.c b/drivers/net/ethernet/lsi/lsi_acp_net.c
index 78b7e79..a46e850 100644
--- a/drivers/net/ethernet/lsi/lsi_acp_net.c
+++ b/drivers/net/ethernet/lsi/lsi_acp_net.c
@@ -701,6 +701,7 @@ static void lsinet_rx_packet(struct net_device *dev)
 	while (0 < queue_initialized(queue, pdata->rx_tail_copy,
 				     pdata->rx_num_desc)) {
 
+		if (skb_tailroom(sk_buff) >= descriptor.pdu_length)
 		{
 			unsigned char *buffer;
 			buffer = skb_put(sk_buff, descriptor.pdu_length);
@@ -708,6 +709,12 @@ static void lsinet_rx_packet(struct net_device *dev)
 			       (void *)(descriptor.host_data_memory_pointer +
 				 pdata->dma_alloc_offset_rx),
 			       descriptor.pdu_length);
+		} else {
+			pr_err("%s: PDU overrun (len %u/%u, err %d)\n",
+			       LSI_DRV_NAME,
+			       descriptor.pdu_length,
+			       bytes_copied,
+			       descriptor.error);
 		}
 		bytes_copied += descriptor.pdu_length;
 		descriptor.data_transfer_length = pdata->rx_buf_per_desc;
-- 
1.8.1.4