linux-kernel - Re: [PATCH net] net: atlantic: fix fragment overflow handling in RX path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CADEc0q5unWeMYznB_gJEUSRTy1HyCZO_8aNHhVpKPy9k0-j8Qg@mail.gmail.com>
Date: Thu, 20 Nov 2025 21:06:18 +0800
From: Jiefeng <jiefeng.z.zhang@...il.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: netdev@...r.kernel.org, davem@...emloft.net, pabeni@...hat.com, 
	andrew+netdev@...n.ch, edumazet@...gle.com, linux-kernel@...r.kernel.org, 
	irusskikh@...vell.com
Subject: Re: [PATCH net] net: atlantic: fix fragment overflow handling in RX path

On Thu, Nov 20, 2025 at 11:03 AM Jakub Kicinski <kuba@...nel.org> wrote:
>
> On Wed, 19 Nov 2025 16:38:13 +0800 Jiefeng wrote:
> > And I have encountered this crash in production with an
> > Aquantia(AQtion AQC113) 10G NIC[Antigua 10G]:
>
> Ah you're actually seeing a crash! Thanks a lot for the additional info,
> I thought this is something you found with static code analysis!
> Please include the stack trace and more info in the commit message,
> makes it easier for others encountering the crash to compare.
> (Drop the timestamps from the crash lines, tho, it's not important)
>

Thank you for the feedback! I've updated the patch to v2 based on your
suggestion to skip extracting the zeroth fragment when frag_cnt ==
MAX_SKB_FRAGS.
This approach is simpler and aligns with your comment that extracting the
zeroth fragment is just a performance optimization, not necessary for
correctness.

I've also included the stack trace from production (without timestamps) in
the commit message:

The fix adds a check to skip extracting the zeroth fragment when
frag_cnt == MAX_SKB_FRAGS, preventing the fragment overflow.

Please review the v2 patch.