netdev - TSOv6 broken in atl1e

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 01 Dec 2009 03:19:39 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Jie Yang <jie.yang@...eros.com>
Cc:	558426@...s.debian.org, netdev <netdev@...r.kernel.org>
Subject: TSOv6 broken in atl1e

I received a bug report <http://bugs.debian.org/558426> that shows atl1e
corrupting IPv6 packets.  I have reproduced this on an Eee PC 901 and
found that it is linked to TSO.  The most obvious thing wrong with the
driver code is that it calculates the super-packet length incorrectly.
However, fixing that:

--- a/drivers/net/atl1e/atl1e_main.c
+++ b/drivers/net/atl1e/atl1e_main.c
@@ -1667,6 +1667,7 @@ static int atl1e_tso_csum(struct atl1e_adapter *adapter,

 		if (offload_type & SKB_GSO_TCPV6) {
 			real_len = (((unsigned char *)ipv6_hdr(skb) - skb->data)
+					+ sizeof(struct ipv6hdr)
 					+ ntohs(ipv6_hdr(skb)->payload_len));
 			if (real_len < skb->len)
 				pskb_trim(skb, real_len);
--- END ---

does not solve the problem.  Presumably this function is not
constructing correct DMA descriptors for TSOv6.

Please fix this, or I will submit a patch to remove this feature from
the driver.

Ben.

-- 
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)