---

yaml --- r: 266450 b: refs/heads/master c: e878d78 h: refs/heads/master v: v3
git-mirror · Oct 6, 2011 · da068c0 · da068c0
1 parent cd1e92d
commit da068c0
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 515853ccecc6987dfb8ed809dd8bf8900286f29e
+refs/heads/master: e878d78b9a7403fabc89ecc93c56928b74d14f01
diff --git a/trunk/drivers/net/virtio_net.c b/trunk/drivers/net/virtio_net.c
@@ -195,6 +195,19 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
 	len -= copy;
 	offset += copy;
 
+	/*
+	 * Verify that we can indeed put this data into a skb.
+	 * This is here to handle cases when the device erroneously
+	 * tries to receive more than is possible. This is usually
+	 * the case of a broken device.
+	 */
+	if (unlikely(len > MAX_SKB_FRAGS * PAGE_SIZE)) {
+		if (net_ratelimit())
+			pr_debug("%s: too much data\n", skb->dev->name);
+		dev_kfree_skb(skb);
+		return NULL;
+	}
+
 	while (len) {
 		set_skb_frag(skb, page, offset, &len);
 		page = (struct page *)page->private;