Szymon Heidrich ecf7cf8efb net: usb: sr9700: Handle negative len
Packet len computed as difference of length word extracted from
skb data and four may result in a negative value. In such case
processing of the buffer should be interrupted rather than
setting sr_skb->len to an unexpectedly large value (due to cast
from signed to unsigned integer) and passing sr_skb to
usbnet_skb_return.

Fixes: e9da0b56fe27 ("sr9700: sanity check for packet length")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Link: https://lore.kernel.org/r/20230114182326.30479-1-szymon.heidrich@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2023-01-17 11:50:42 +01:00
..
2022-08-26 10:00:52 +01:00
2021-10-02 14:18:25 +01:00
2022-07-01 13:39:03 +01:00
2021-10-02 14:18:25 +01:00
2022-08-26 10:00:52 +01:00
2021-10-22 10:15:56 -07:00
2023-01-17 11:50:42 +01:00