[PATCH net v2 12/12] net: au1000: reject frames larger than the TX bounce buffer

[Florian Fainelli <f.fainelli@gmail.com>]

au1000_tx() copies skb->len bytes into a MAX_BUF_SIZE coherent buffer
without checking the length. Oversized non-GSO packets can reach this
path through AF_PACKET with PACKET_VNET_HDR and PACKET_TX_RING, whose
MTU checks are skipped when a virtio header is present. The copy can
corrupt neighboring DMA buffers or run beyond the coherent allocation.

Drop oversized packets before touching the ring or copying any data,
and account them in tx_dropped. Use an IRQ-safe skb free for netpoll.

Identified by Sashiko AI review; implementation and validation assisted
by OpenAI Codex. An extracted-function harness passed ASan/UBSan checks
for 2049- and 4096-byte drops and a 2048-byte accepted frame, as well as
TX ring regression cases. MIPS driver compilation and checkpatch passed.
The complete AF_PACKET trigger and hardware operation were not tested.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
 drivers/net/ethernet/amd/au1000_eth.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/amd/au1000_eth.c b/drivers/net/ethernet/amd/au1000_eth.c
index d60430a3795e..d8855ccf87aa 100644
--- a/drivers/net/ethernet/amd/au1000_eth.c
+++ b/drivers/net/ethernet/amd/au1000_eth.c
@@ -1008,6 +1008,12 @@ static netdev_tx_t au1000_tx(struct sk_buff *skb, struct net_device *dev)
 	int i;
 	unsigned long flags;
 
+	if (unlikely(skb->len > MAX_BUF_SIZE)) {
+		dev->stats.tx_dropped++;
+		dev_kfree_skb_any(skb);
+		return NETDEV_TX_OK;
+	}
+
 	netif_dbg(aup, tx_queued, dev, "tx: aup %x len=%d, data=%p, head %d\n",
 				(unsigned)aup, skb->len,
 				skb->data, aup->tx_head);
-- 
2.53.0