net: usb: sr9700: Handle negative len

stable inclusion
from stable-v5.10.166
commit 67866b1e0ab9ca7858547c38f8f69d45892e67a8
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I87FRA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=67866b1e0ab9ca7858547c38f8f69d45892e67a8



--------------------------------

[ Upstream commit ecf7cf8e ]

Packet len computed as difference of length word extracted from
skb data and four may result in a negative value. In such case
processing of the buffer should be interrupted rather than
setting sr_skb->len to an unexpectedly large value (due to cast
from signed to unsigned integer) and passing sr_skb to
usbnet_skb_return.

Fixes: e9da0b56 ("sr9700: sanity check for packet length")
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Link: https://lore.kernel.org/r/20230114182326.30479-1-szymon.heidrich@gmail.com


Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: sanglipeng <sanglipeng1@jd.com>