netdev - [PATCH] ibmveth: fix bad UDP checksums

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 20 Aug 2008 13:09:19 -0600
From:	Santiago Leon <santil@...ibm.com>
To:	jeff@...zik.org
Cc:	Santiago Leon <santil@...ibm.com>, netdev@...r.kernel.org
Subject: [PATCH] ibmveth: fix bad UDP checksums

This patch fixes a ibmveth bug where bad UDP checksums are being transmitted 
when checksum offloading is enabled.
The hypervisor does checksum offloading only on TCP packets, so ibmveth calls 
skb_checksum_help() for any other protocol.  The bug happens because 
the packet is being modified after the DMA map, so we would need a memory 
barrier before making the hypervisor call.  Reordering the code so that the 
DMA map happens after skb_checksum_help() has the additional advantage of 
fixing a DMA map leak if skb_checksum_help() where to fail.

Please consider applying.

Signed-off-by: Santiago Leon <santil@...ibm.com>
---

 ibmveth.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/ibmveth.c	2008-08-19 07:31:29.000000000 -0400
+++ b/drivers/net/ibmveth.c	2008-08-19 07:46:24.000000000 -0400
@@ -904,8 +904,6 @@ static int ibmveth_start_xmit(struct sk_
 	unsigned long data_dma_addr;
 
 	desc.fields.flags_len = IBMVETH_BUF_VALID | skb->len;
-	data_dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
-				       skb->len, DMA_TO_DEVICE);
 
 	if (skb->ip_summed == CHECKSUM_PARTIAL &&
 	    ip_hdr(skb)->protocol != IPPROTO_TCP && skb_checksum_help(skb)) {
@@ -924,6 +922,8 @@ static int ibmveth_start_xmit(struct sk_
 		buf[1] = 0;
 	}
 
+	data_dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
+				       skb->len, DMA_TO_DEVICE);
 	if (dma_mapping_error(&adapter->vdev->dev, data_dma_addr)) {
 		if (!firmware_has_feature(FW_FEATURE_CMO))
 			ibmveth_error_printk("tx: unable to map xmit buffer\n");
@@ -932,6 +932,7 @@ static int ibmveth_start_xmit(struct sk_
 		desc.fields.address = adapter->bounce_buffer_dma;
 		tx_map_failed++;
 		used_bounce = 1;
+		wmb();
 	} else
 		desc.fields.address = data_dma_addr;
 
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html