[PATCH RESEND 1/4] usb: eth: r8152: Check the rx descriptor fits in the transfer

[Ana Bobillo <anabobillo3@gmail.com>]

From: Ana Bobillo <anabobillo3@gmail.com>

r8152_eth_recv() reads the rx descriptor at the start of what is left of
the transfer without checking that a whole descriptor is there, and then
bounds the packet length with

	if (packet_len > len - (sizeof(struct rx_desc) + CRC_SIZE))

which is evaluated in size_t: when fewer than 28 bytes are left it wraps
and lets any packet length through, including one that wrapped in its
u16 because the descriptor gave a length below CRC_SIZE. A short
transfer from the adapter then hands the network stack a packet whose
start and length run past the received data, and past the end of the
2 KiB receive buffer.

Require a whole descriptor and CRC before reading the descriptor, and
work in int so that neither length can wrap.

Signed-off-by: Ana Bobillo <anabobillo3@gmail.com>
---
 drivers/usb/eth/r8152.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/eth/r8152.c b/drivers/usb/eth/r8152.c
index e3f20e08c33..19b3f0bc22a 100644
--- a/drivers/usb/eth/r8152.c
+++ b/drivers/usb/eth/r8152.c
@@ -1471,9 +1471,8 @@ int r8152_eth_recv(struct udevice *dev, int flags, uchar **packetp)
 	struct r8152 *tp = dev_get_priv(dev);
 	struct ueth_data *ueth = &tp->ueth;
 	uint8_t *ptr;
-	int ret, len;
+	int ret, len, packet_len;
 	struct rx_desc *rx_desc;
-	u16 packet_len;
 
 	len = usb_ether_get_rx_bytes(ueth, &ptr);
 	debug("%s: first try, len=%d\n", __func__, len);
@@ -1488,12 +1487,18 @@ int r8152_eth_recv(struct udevice *dev, int flags, uchar **packetp)
 		debug("%s: second try, len=%d\n", __func__, len);
 	}
 
+	if (len < (int)(sizeof(struct rx_desc) + CRC_SIZE)) {
+		debug("Rx: incomplete packet: %d\n", len);
+		goto err;
+	}
+
 	rx_desc = (struct rx_desc *)ptr;
 	packet_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
 	packet_len -= CRC_SIZE;
 
-	if (packet_len > len - (sizeof(struct rx_desc) + CRC_SIZE)) {
-		debug("Rx: too large packet: %d\n", packet_len);
+	if (packet_len < 0 ||
+	    packet_len > len - (int)(sizeof(struct rx_desc) + CRC_SIZE)) {
+		debug("Rx: bad packet length: %d\n", packet_len);
 		goto err;
 	}