# Re: \[PATCH net v2\] net: bgmac: fix oversized RX frame check

- From: Florian Fainelli \<florian.fainelli@broadcom.com\>
- Date: 2026-10-28 17:00:12 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/10/17818540
- Thread: https://ratatoskr.run/netdev/2026/10/17814079/t.md

```text
On 10/27/26 18:10, Rosen Penev wrote:
> While reviewing commit 77dac783f11
> ("net: bgmac: rate limit RX error messages") , Florian spotted that the RX
> length sanity check compares the length reported in the RX header against
> BGMAC_RX_ALLOC_SIZE. That is the size of the whole fragment, including the
> space reserved for struct skb_shared_info. The data area handed to the
> hardware is only BGMAC_RX_BUF_SIZE bytes, and the frame starts
> BGMAC_RX_FRAME_OFFSET bytes into it, so a valid frame is at most
> BGMAC_RX_MAX_FRAME_SIZE bytes long.
>
> A corrupted length between those two limits passes the check, and the
> following skb_put() runs past the skb tailroom and calls
> skb_over_panic() instead of dropping the frame.
>
> Compare against BGMAC_RX_MAX_FRAME_SIZE instead.
>
> Only compile tested. Not tested on hardware.
>
> Fixes: 6a6c708469c9 ("bgmac: add check for oversized packets")
> Signed-off-by: Rosen Penev <redacted>

Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
-- 
Florian
```