Prasad J Pandit 8ffb7265af net: tulip: check frame size and r/w data length
Tulip network driver while copying tx/rx buffers does not check
frame size against r/w data length. This may lead to OOB buffer
access. Add check to avoid it.

Limit iterations over descriptors to avoid potential infinite
loop issue in tulip_xmit_list_update.

Reported-by: Li Qiang <pangpei.lq@antfin.com>
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Reported-by: Jason Wang <jasowang@redhat.com>
Tested-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-03-31 21:14:35 +08:00
..
2019-06-12 13:20:21 +02:00
2019-08-16 13:31:53 +02:00
2019-08-16 13:31:52 +02:00
2018-03-02 18:44:00 +00:00
2019-08-16 13:31:53 +02:00
2020-01-07 17:24:29 +04:00
2019-10-29 10:28:07 +08:00
2019-06-12 13:20:21 +02:00
2019-08-16 13:31:52 +02:00