Merge tag 'v4.4.214' into 10

[sagit-ice-cold/kernel_xiaomi_msm8998.git] / drivers / staging / most / aim-network / networking.c

diff --git a/drivers/staging/most/aim-network/networking.c b/drivers/staging/most/aim-network/networking.c
index 3c7beb0..350fa05 100644 (file)
--- a/drivers/staging/most/aim-network/networking.c
+++ b/drivers/staging/most/aim-network/networking.c
@@ -87,6 +87,11 @@ static int skb_to_mamac(const struct sk_buff *skb, struct mbo *mbo)
        unsigned int payload_len = skb->len - ETH_HLEN;
        unsigned int mdp_len = payload_len + MDP_HDR_LEN;
 
+       if (mdp_len < skb->len) {
+               pr_err("drop: too large packet! (%u)\n", skb->len);
+               return -EINVAL;
+       }
+
        if (mbo->buffer_length < mdp_len) {
                pr_err("drop: too small buffer! (%d for %d)\n",
                       mbo->buffer_length, mdp_len);
@@ -134,6 +139,11 @@ static int skb_to_mep(const struct sk_buff *skb, struct mbo *mbo)
        u8 *buff = mbo->virt_address;
        unsigned int mep_len = skb->len + MEP_HDR_LEN;
 
+       if (mep_len < skb->len) {
+               pr_err("drop: too large packet! (%u)\n", skb->len);
+               return -EINVAL;
+       }
+
        if (mbo->buffer_length < mep_len) {
                pr_err("drop: too small buffer! (%d for %d)\n",
                       mbo->buffer_length, mep_len);