| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID:
<BL3PR12MB6571F73095B337D0527EE102C98AA@BL3PR12MB6571.namprd12.prod.outlook.com>
Date: Fri, 9 May 2025 06:08:59 +0000
From: "Gupta, Suraj" <Suraj.Gupta2@....com>
To: Can Ayberk Demir <ayberkdemir@...il.com>, "netdev@...r.kernel.org"
<netdev@...r.kernel.org>
CC: "Pandey, Radhey Shyam" <radhey.shyam.pandey@....com>, Andrew Lunn
<andrew+netdev@...n.ch>, "David S . Miller" <davem@...emloft.net>, Eric
Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
<pabeni@...hat.com>, "Simek, Michal" <michal.simek@....com>,
"linux-arm-kernel@...ts.infradead.org"
<linux-arm-kernel@...ts.infradead.org>, "linux-kernel@...r.kernel.org"
<linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] drivers: net: axienet: safely drop oversized RX frames
[AMD Official Use Only - AMD Internal Distribution Only]
> -----Original Message-----
> From: Can Ayberk Demir <ayberkdemir@...il.com>
> Sent: Thursday, May 8, 2025 8:34 PM
> To: netdev@...r.kernel.org
> Cc: Pandey, Radhey Shyam <radhey.shyam.pandey@....com>; Andrew Lunn
> <andrew+netdev@...n.ch>; David S . Miller <davem@...emloft.net>; Eric
> Dumazet <edumazet@...gle.com>; Jakub Kicinski <kuba@...nel.org>; Paolo
> Abeni <pabeni@...hat.com>; Simek, Michal <michal.simek@....com>; linux-arm-
> kernel@...ts.infradead.org; linux-kernel@...r.kernel.org; Can Ayberk DEMIR
> <ayberkdemir@...il.com>
> Subject: [PATCH] drivers: net: axienet: safely drop oversized RX frames
>
> Caution: This message originated from an External Source. Use proper caution
> when opening attachments, clicking links, or responding.
>
>
> From: Can Ayberk DEMIR <ayberkdemir@...il.com>
>
> In AXI Ethernet (axienet) driver, receiving an Ethernet frame larger than the allocated
> skb buffer may cause memory corruption or kernel panic, especially when the
> interface MTU is small and a jumbo frame is received.
>
> Signed-off-by: Can Ayberk DEMIR <ayberkdemir@...il.com>
> ---
> .../net/ethernet/xilinx/xilinx_axienet_main.c | 46 +++++++++++--------
> 1 file changed, 27 insertions(+), 19 deletions(-)
>
Please fix alignment and coding styles, some of them reported by checkpatch:
CHECK: Alignment should match open parenthesis
#46: FILE: drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1228:
+ netdev_warn(ndev,
+ "Dropping oversized RX frame (len=%u, tailroom=%u)\n",
ERROR: space required before the open brace '{'
#50: FILE: drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1232:
+ }else{
ERROR: space required after that close brace '}'
#50: FILE: drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1232:
+ }else{
CHECK: Alignment should match open parenthesis
#61: FILE: drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1243:
+ if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
+ csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
total: 2 errors, 0 warnings, 2 checks, 55 lines checked
FYR: https://www.kernel.org/doc/html/v4.10/process/coding-style.html
> diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> index 1b7a653c1f4e..a74ac8fe8ea8 100644
> --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> @@ -1223,28 +1223,36 @@ static int axienet_rx_poll(struct napi_struct *napi, int
> budget)
> dma_unmap_single(lp->dev, phys, lp->max_frm_size,
> DMA_FROM_DEVICE);
>
> - skb_put(skb, length);
> - skb->protocol = eth_type_trans(skb, lp->ndev);
> - /*skb_checksum_none_assert(skb);*/
> - skb->ip_summed = CHECKSUM_NONE;
> -
> - /* if we're doing Rx csum offload, set it up */
> - if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
> - csumstatus = (cur_p->app2 &
> - XAE_FULL_CSUM_STATUS_MASK) >> 3;
> - if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
> - csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
> - skb->ip_summed = CHECKSUM_UNNECESSARY;
> + if (unlikely(length > skb_tailroom(skb))) {
> + netdev_warn(ndev,
> + "Dropping oversized RX frame (len=%u,
> tailroom=%u)\n",
> + length, skb_tailroom(skb));
> + dev_kfree_skb(skb);
> + skb = NULL;
> + }else{
> + skb_put(skb, length);
> + skb->protocol = eth_type_trans(skb, lp->ndev);
> + /*skb_checksum_none_assert(skb);*/
> + skb->ip_summed = CHECKSUM_NONE;
> +
> + /* if we're doing Rx csum offload, set it up */
> + if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
> + csumstatus = (cur_p->app2 &
> + XAE_FULL_CSUM_STATUS_MASK) >> 3;
> + if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
> + csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
> + skb->ip_summed = CHECKSUM_UNNECESSARY;
> + }
> + } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM)
> {
> + skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
> + skb->ip_summed =
> + CHECKSUM_COMPLETE;
> }
> - } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) {
> - skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
> - skb->ip_summed = CHECKSUM_COMPLETE;
> - }
>
> - napi_gro_receive(napi, skb);
> + napi_gro_receive(napi, skb);
>
> - size += length;
> - packets++;
> + size += length;
> + packets++;
> + }
> }
>
> new_skb = napi_alloc_skb(napi, lp->max_frm_size);
> --
> 2.39.5 (Apple Git-154)
>
Powered by blists - more mailing lists