summaryrefslogtreecommitdiff
path: root/drivers/net/usb/sr9700.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/net/usb/sr9700.c')
-rw-r--r--drivers/net/usb/sr9700.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 5a53e63d33a6..3164451e1010 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -413,7 +413,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
/* ignore the CRC length */
len = (skb->data[1] | (skb->data[2] << 8)) - 4;
- if (len > ETH_FRAME_LEN || len > skb->len)
+ if (len > ETH_FRAME_LEN || len > skb->len || len < 0)
return 0;
/* the last packet of current skb */