linux-kernel - [PATCH] drivers/net/usb/r8152 fix broken rx checksums

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <987cfbab-2b48-e28c-1706-967cb2051d63@pobox.com>
Date:   Wed, 26 Oct 2016 18:36:57 -0400
From:   Mark Lord <mlord@...ox.com>
To:     nic_swsd@...ltek.com, netdev@...r.kernel.org,
        Linux Kernel <linux-kernel@...r.kernel.org>
Cc:     stable@...r.kernel.org
Subject: [PATCH] drivers/net/usb/r8152 fix broken rx checksums

The r8152 driver has been broken since (approx) 3.6.16,
when support was added for hardware rx checksum on newer chip versions.
Symptoms include random segfaults and silent data corruption over NFS.

This does not work on the VER_02 dongle I have here
when used with a slow embedded system CPU.
Google reveals others reporting similar issues on Raspberry Pi.

So, disable hardware rx checksum for VER_02, and fix
an obvious coding error for IPV6 checksums in the same function.

Because this bug results in silent data corruption,
it is a good candidate for back-porting to -stable >= 3.16.xx.
Patch attached (to deal with buggy mailer) and also below for review.

Signed-off-by: Mark Lord <mlord@...ox.com>

--- old/drivers/net/usb/r8152.c	2016-09-30 04:20:43.000000000 -0400
+++ linux/drivers/net/usb/r8152.c	2016-10-26 14:15:44.932517676 -0400
@@ -1645,7 +1645,7 @@
  	u8 checksum = CHECKSUM_NONE;
  	u32 opts2, opts3;

-	if (tp->version == RTL_VER_01)
+	if (tp->version == RTL_VER_01 || tp->version == RTL_VER_02)
  		goto return_result;

  	opts2 = le32_to_cpu(rx_desc->opts2);
@@ -1660,7 +1660,7 @@
  			checksum = CHECKSUM_NONE;
  		else
  			checksum = CHECKSUM_UNNECESSARY;
-	} else if (RD_IPV6_CS) {
+	} else if (opts2 & RD_IPV6_CS) {
  		if ((opts2 & RD_UDP_CS) && !(opts3 & UDPF))
  			checksum = CHECKSUM_UNNECESSARY;
  		else if ((opts2 & RD_TCP_CS) && !(opts3 & TCPF))

View attachment "drivers_net_usb_r8152_checksums.patch" of type "text/x-patch" (1307 bytes)