linux-kernel - Re: [PATCH net v2] r8169: Fix possible ring buffer corruption on fragmented Tx packets.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 22 May 2024 07:35:06 +0200
From: Heiner Kallweit <hkallweit1@...il.com>
To: Ken Milmore <ken.milmore@...il.com>,
 "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Cc: nic_swsd@...ltek.com, "\"David S. Miller\",Eric Dumazet"
 <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net v2] r8169: Fix possible ring buffer corruption on
 fragmented Tx packets.

On 22.05.2024 00:45, Ken Milmore wrote:
> An issue was found on the RTL8125b when transmitting small fragmented
> packets, whereby invalid entries were inserted into the transmit ring
> buffer, subsequently leading to calls to dma_unmap_single() with a null
> address.
> 
> This was caused by rtl8169_start_xmit() not noticing changes to nr_frags
> which may occur when small packets are padded (to work around hardware
> quirks) in rtl8169_tso_csum_v2().
> 
> To fix this, postpone inspecting nr_frags until after any padding has been
> applied.
> 
> Fixes: 9020845fb5d6 ("r8169: improve rtl8169_start_xmit")
> Cc: stable@...r.kernel.org
> Signed-off-by: Ken Milmore <ken.milmore@...il.com>
> ---

Reviewed-by: Heiner Kallweit <hkallweit1@...il.com>