netdev - [PATCH] Net: ethernet: ti: netcp: Fix inbound ping crash if MTU size is greater than 1500

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu, 22 Mar 2018 21:01:36 +0000
From:   "Chang, Rex" <rchang@...com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "Karicheri, Muralidharan" <m-karicheri2@...com>,
        "Kwok, WingMan" <w-kwok2@...com>
Subject: [PATCH] Net: ethernet: ti: netcp: Fix inbound   ping crash if MTU
 size is greater than 1500

I am requesting to merge this patch to the stable releases:

commit 5a717843177c96ca3fe4565187de395afdb28092

Kernel crashes if MTU is greater than 1500. This code was working in Kernel v 3.14, but got broken when migrating from Kernel v3.14 to v 4.1.

Stable versions to apply: v4.1 and v4.4.

Thanks!

Rex

-----Original Message-----
From: David Miller [mailto:davem@...emloft.net] 
Sent: Wednesday, January 17, 2018 4:20 PM
To: Chang, Rex
Cc: Kwok, WingMan; Karicheri, Muralidharan; netdev@...r.kernel.org; linux-kernel@...r.kernel.org
Subject: [EXTERNAL] Re: [PATCH] Net: ethernet: ti: netcp: Fix inbound ping crash if MTU size is greater than 1500

From: Rex Chang <rchang@...com>
Date: Tue, 16 Jan 2018 15:16:01 -0500

> In the receive queue for 4096 bytes fragments, the page address set in 
> the SW data0 field of the descriptor is not the one we got when doing 
> the reassembly in receive. The page structure was retrieved from the 
> wrong descriptor into SW data0 which is then causing a page fault when 
> UDP checksum is accessing data above 1500.
> 
> Signed-off-by: Rex Chang <rchang@...com>

Applied, thank you.