| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID:
<BL3PR12MB6571553A36BAC1F5465CCAD8C98AA@BL3PR12MB6571.namprd12.prod.outlook.com>
Date: Fri, 9 May 2025 08:18:48 +0000
From: "Gupta, Suraj" <Suraj.Gupta2@....com>
To: "Gupta, Suraj" <Suraj.Gupta2@....com>, Can Ayberk Demir
<ayberkdemir@...il.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC: "Pandey, Radhey Shyam" <radhey.shyam.pandey@....com>, Andrew Lunn
<andrew+netdev@...n.ch>, "David S . Miller" <davem@...emloft.net>, Eric
Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
<pabeni@...hat.com>, "Simek, Michal" <michal.simek@....com>,
"linux-arm-kernel@...ts.infradead.org"
<linux-arm-kernel@...ts.infradead.org>, "linux-kernel@...r.kernel.org"
<linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v2] drivers: net: axienet: safely drop oversized RX frames
[AMD Official Use Only - AMD Internal Distribution Only]
> -----Original Message-----
> From: Gupta, Suraj <Suraj.Gupta2@....com>
> Sent: Friday, May 9, 2025 1:36 PM
> To: Can Ayberk Demir <ayberkdemir@...il.com>; netdev@...r.kernel.org
> Cc: Pandey, Radhey Shyam <radhey.shyam.pandey@....com>; Andrew Lunn
> <andrew+netdev@...n.ch>; David S . Miller <davem@...emloft.net>; Eric
> Dumazet <edumazet@...gle.com>; Jakub Kicinski <kuba@...nel.org>; Paolo
> Abeni <pabeni@...hat.com>; Simek, Michal <michal.simek@....com>; linux-
> arm-kernel@...ts.infradead.org; linux-kernel@...r.kernel.org
> Subject: RE: [PATCH v2] drivers: net: axienet: safely drop oversized RX frames
>
> [AMD Official Use Only - AMD Internal Distribution Only]
>
> Caution: This message originated from an External Source. Use proper caution
> when opening attachments, clicking links, or responding.
>
>
> [AMD Official Use Only - AMD Internal Distribution Only]
>
> > -----Original Message-----
> > From: Can Ayberk Demir <ayberkdemir@...il.com>
> > Sent: Friday, May 9, 2025 12:07 PM
> > To: netdev@...r.kernel.org
> > Cc: Pandey, Radhey Shyam <radhey.shyam.pandey@....com>; Andrew Lunn
> > <andrew+netdev@...n.ch>; David S . Miller <davem@...emloft.net>; Eric
> > Dumazet <edumazet@...gle.com>; Jakub Kicinski <kuba@...nel.org>; Paolo
> > Abeni <pabeni@...hat.com>; Simek, Michal <michal.simek@....com>;
> > linux- arm-kernel@...ts.infradead.org; linux-kernel@...r.kernel.org;
> > Can Ayberk DEMIR <ayberkdemir@...il.com>
> > Subject: [PATCH v2] drivers: net: axienet: safely drop oversized RX
> > frames
> >
>
> Since it's bug fix, please use subject prefix [Patch net vx]
>
>
There are compilation errors in your patch. Please test the build and basic data transfer.
drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1227:45: error: 'ndev' undeclared (first use in this function); did you mean 'cdev'?
1227 | netdev_warn(ndev,
| ^~~~
| cdev
> > Caution: This message originated from an External Source. Use proper
> > caution when opening attachments, clicking links, or responding.
> >
> >
> > From: Can Ayberk DEMIR <ayberkdemir@...il.com>
> >
> > This patch addresses style issues pointed out in v1.
>
> Please add changelogs below "---" after SOB
> >
> > In AXI Ethernet (axienet) driver, receiving an Ethernet frame larger
> > than the allocated skb buffer may cause memory corruption or kernel
> > panic, especially when the interface MTU is small and a jumbo frame is received.
> >
>
> Please add Fixes tag and better to add call trace of kernel crash.
>
> > Signed-off-by: Can Ayberk DEMIR <ayberkdemir@...il.com>
> > ---
> > .../net/ethernet/xilinx/xilinx_axienet_main.c | 46
> > +++++++++++--------
> > 1 file changed, 27 insertions(+), 19 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> > b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> > index 1b7a653c1f4e..2b375dd06def 100644
> > --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> > +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
> > @@ -1223,28 +1223,36 @@ static int axienet_rx_poll(struct napi_struct
> > *napi, int
> > budget)
> > dma_unmap_single(lp->dev, phys, lp->max_frm_size,
> > DMA_FROM_DEVICE);
> >
> > - skb_put(skb, length);
> > - skb->protocol = eth_type_trans(skb, lp->ndev);
> > - /*skb_checksum_none_assert(skb);*/
> > - skb->ip_summed = CHECKSUM_NONE;
> > -
> > - /* if we're doing Rx csum offload, set it up */
> > - if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
> > - csumstatus = (cur_p->app2 &
> > - XAE_FULL_CSUM_STATUS_MASK) >> 3;
> > - if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
> > - csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
> > - skb->ip_summed = CHECKSUM_UNNECESSARY;
> > + if (unlikely(length > skb_tailroom(skb))) {
> > + netdev_warn(ndev,
> > + "Dropping oversized RX
> > + frame (len=%u,
> > tailroom=%u)\n",
> > + length, skb_tailroom(skb));
> > + dev_kfree_skb(skb);
> > + skb = NULL;
>
> Update packet drop in netdev stats?
>
> > + } else {
> > + skb_put(skb, length);
> > + skb->protocol = eth_type_trans(skb, lp->ndev);
> > + /*skb_checksum_none_assert(skb);*/
> > + skb->ip_summed = CHECKSUM_NONE;
> > +
> > + /* if we're doing Rx csum offload, set it up */
> > + if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
> > + csumstatus = (cur_p->app2 &
> > + XAE_FULL_CSUM_STATUS_MASK) >> 3;
> > + if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
> > + csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
> > + skb->ip_summed =
> CHECKSUM_UNNECESSARY;
> > + }
> > + } else if (lp->features &
> > XAE_FEATURE_PARTIAL_RX_CSUM) {
> > + skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
> > + skb->ip_summed =
> > + CHECKSUM_COMPLETE;
> > }
> > - } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) {
> > - skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
> > - skb->ip_summed = CHECKSUM_COMPLETE;
> > - }
> >
> > - napi_gro_receive(napi, skb);
> > + napi_gro_receive(napi, skb);
> >
> > - size += length;
> > - packets++;
> > + size += length;
> > + packets++;
> > + }
> > }
> >
> > new_skb = napi_alloc_skb(napi, lp->max_frm_size);
> > --
> > 2.39.5 (Apple Git-154)
> >
>
Powered by blists - more mailing lists