diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c index c247dfa0bd1d..1010eb5d2fc1 100644 --- a/drivers/net/usb/ax88179_178a.c +++ b/drivers/net/usb/ax88179_178a.c @@ -1064,62 +1064,14 @@ static void ax88179_rx_fixup pkt_cnt = rx_hdr & 0xFF; pkt_hdr_curr = hdr_off = rx_hdr >> 16; - /* Make sure that the bounds of the metadata array are inside the SKB - * (and in front of the counter at the end). - */ - if (pkt_cnt * 4 + hdr_off > skb->len) - return 0; - pkt_hdr = (u32 *)(skb->data + hdr_off); - - /* Packets must not overlap the metadata array */ - skb_trim(skb, hdr_off); - - for (; pkt_cnt > 0; pkt_cnt--, pkt_hdr++) { - u16 pkt_len_plus_padd; - u16 pkt_len; - - le32_to_cpus(pkt_hdr); - pkt_len = (*pkt_hdr >> 16) & 0x1fff; - pkt_len_plus_padd = (pkt_len + 7) & 0xfff8; - - /* Skip dummy header used for alignment - */ - if (pkt_len == 0) - continue; - - if (pkt_len_plus_padd > skb->len) - return 0; - - /* Check CRC or runt packet */ - if ((*pkt_hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) || - pkt_len < 2 + ETH_HLEN) { - dev->net->stats.rx_errors++; - skb_pull(skb, pkt_len_plus_padd); - continue; - } - - /* last packet */ - if (pkt_len_plus_padd == skb->len) { - skb_trim(skb, pkt_len); - - /* Skip IP alignment pseudo header */ - skb_pull(skb, 2); - - ax88179_rx_checksum(skb, pkt_hdr); - return 1; - } - - ax_skb = netdev_alloc_skb_ip_align(dev->net, pkt_len); - if (!ax_skb) - return 0; - skb_put(ax_skb, pkt_len); - memcpy(ax_skb->data, skb->data + 2, pkt_len); - - ax88179_rx_checksum(ax_skb, pkt_hdr); - usbnet_skb_return(dev, ax_skb); - - skb_pull(skb, pkt_len_plus_padd); - } + aa = (actual_length - (((pkt_cnt + 2) & 0xFE) * 4)); + if ((aa != hdr_off) || + (hdr_off >= desc->urb->actual_length) || + (pkt_cnt == 0)) { + desc->urb->actual_length = 0; + stats->rx_length_errors++; + return; + } rx_data = desc->head; while (pkt_cnt--) {