lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID:
 <BL3PR12MB65713C8109035EC83DE8C9BBC98AA@BL3PR12MB6571.namprd12.prod.outlook.com>
Date: Fri, 9 May 2025 15:17:19 +0000
From: "Gupta, Suraj" <Suraj.Gupta2@....com>
To: Can Ayberk Demir <ayberkdemir@...il.com>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>
CC: "Pandey, Radhey Shyam" <radhey.shyam.pandey@....com>, Andrew Lunn
	<andrew+netdev@...n.ch>, "David S . Miller" <davem@...emloft.net>, Eric
 Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>, "Simek, Michal" <michal.simek@....com>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: RE: [PATCH net v3] net: axienet: safely drop oversized RX frames

[AMD Official Use Only - AMD Internal Distribution Only]

> -----Original Message-----
> From: Can Ayberk Demir <ayberkdemir@...il.com>
> Sent: Friday, May 9, 2025 4:18 PM
> To: netdev@...r.kernel.org
> Cc: Pandey, Radhey Shyam <radhey.shyam.pandey@....com>; Andrew Lunn
> <andrew+netdev@...n.ch>; David S . Miller <davem@...emloft.net>; Eric
> Dumazet <edumazet@...gle.com>; Jakub Kicinski <kuba@...nel.org>; Paolo
> Abeni <pabeni@...hat.com>; Simek, Michal <michal.simek@....com>; linux-arm-
> kernel@...ts.infradead.org; linux-kernel@...r.kernel.org; Can Ayberk DEMIR
> <ayberkdemir@...il.com>
> Subject: [PATCH net v3] net: axienet: safely drop oversized RX frames
>
> Caution: This message originated from an External Source. Use proper caution
> when opening attachments, clicking links, or responding.
>
>
> From: Can Ayberk DEMIR <ayberkdemir@...il.com>
>
> In AXI Ethernet (axienet) driver, receiving an Ethernet frame larger than the allocated
> skb buffer may cause memory corruption or kernel panic, especially when the
> interface MTU is small and a jumbo frame is received.
>
> Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
Please move it just before SOB.

>
> This bug was discovered during testing on a Kria K26 platform. When an oversized
> frame is received and `skb_put()` is called without checking the tailroom, the
> following kernel panic occurs:
>
>   skb_panic+0x58/0x5c
>   skb_put+0x90/0xb0
>   axienet_rx_poll+0x130/0x4ec
>   ...
>   Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt
>
> Signed-off-by: Can Ayberk DEMIR <ayberkdemir@...il.com>
> ---

Tested with zcu102 setup.
Tested-by: <suraj.gupta2@....com>

> Changes in v3:
> - Fixed 'ndev' undeclared error → replaced with 'lp->ndev'
> - Added rx_dropped++ for statistics
> - Added Fixes: tag
>
> Changes in v2:
> - This patch addresses style issues pointed out in v1.
> ---
>  .../net/ethernet/xilinx/xilinx_axienet_main.c | 47 +++++++++++--------
>  1 file changed, 28 insertions(+), 19 deletions(-)
>
> diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> index 1b7a653c1f4e..7a12132e2b7c 100644
> --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> @@ -1223,28 +1223,37 @@ static int axienet_rx_poll(struct napi_struct *napi, int
> budget)
>                         dma_unmap_single(lp->dev, phys, lp->max_frm_size,
>                                          DMA_FROM_DEVICE);
>
> -                       skb_put(skb, length);
> -                       skb->protocol = eth_type_trans(skb, lp->ndev);
> -                       /*skb_checksum_none_assert(skb);*/
> -                       skb->ip_summed = CHECKSUM_NONE;
> -
> -                       /* if we're doing Rx csum offload, set it up */
> -                       if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
> -                               csumstatus = (cur_p->app2 &
> -                                             XAE_FULL_CSUM_STATUS_MASK) >> 3;
> -                               if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
> -                                   csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
> -                                       skb->ip_summed = CHECKSUM_UNNECESSARY;
> +                       if (unlikely(length > skb_tailroom(skb))) {
> +                               netdev_warn(lp->ndev,
> +                                           "Dropping oversized RX frame (len=%u,
> tailroom=%u)\n",
> +                                           length, skb_tailroom(skb));
> +                               dev_kfree_skb(skb);
> +                               lp->ndev->stats.rx_dropped++;
> +                               skb = NULL;
> +                       } else {
> +                               skb_put(skb, length);
> +                               skb->protocol = eth_type_trans(skb, lp->ndev);
> +                               /*skb_checksum_none_assert(skb);*/
> +                               skb->ip_summed = CHECKSUM_NONE;
> +
> +                               /* if we're doing Rx csum offload, set it up */
> +                               if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
> +                                       csumstatus = (cur_p->app2 &
> +                                                       XAE_FULL_CSUM_STATUS_MASK) >> 3;
> +                                       if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
> +                                           csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
> +                                               skb->ip_summed = CHECKSUM_UNNECESSARY;
> +                                       }
> +                               } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM)
> {
> +                                       skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
> +                                       skb->ip_summed =
> + CHECKSUM_COMPLETE;
>                                 }
> -                       } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) {
> -                               skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
> -                               skb->ip_summed = CHECKSUM_COMPLETE;
> -                       }
>
> -                       napi_gro_receive(napi, skb);
> +                               napi_gro_receive(napi, skb);
>
> -                       size += length;
> -                       packets++;
> +                               size += length;
> +                               packets++;
> +                       }
>                 }
>
>                 new_skb = napi_alloc_skb(napi, lp->max_frm_size);
> --
> 2.39.5 (Apple Git-154)
>

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ