netdev - Re: VIA velocity skb leak.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 12 Mar 2009 05:45:57 +0100
From:	Eric Dumazet <dada1@...mosbay.com>
To:	Dave Jones <davej@...hat.com>
CC:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: VIA velocity skb leak.

Dave Jones a écrit :
> On Wed, Mar 11, 2009 at 09:20:09PM -0700, David Miller wrote:
>  > From: David Miller <davem@...emloft.net>
>  > Date: Wed, 11 Mar 2009 21:17:06 -0700 (PDT)
>  > 
>  > > 
>  > > velocity_xmit() needs to set 'pktlen = skb->len;' after,
>  > > not before, the skb_padto() call.
>  > 
>  > Actually that won't work since, as you suggest, skb->len
>  > isn't updated by skb_padto().
>  > 
>  > So the transmit needs something like:
>  > 
>  > 	pktlen = (skb->len > ETH_ZLEN ? : ETH_ZLEN);
>  > 
>  > velocity_free_tx_buf() needs to make the same calculation
>  > instead of just plain skb->len
> 
> Something like this ?
> (It looks like the ZERO_COPY_SUPPORT is never enabled anywhere,
>  so I didn't dig into how that works).
> 
> diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
> index c5691fd..cd34dda 100644
> --- a/drivers/net/via-velocity.c
> +++ b/drivers/net/via-velocity.c
> @@ -1838,6 +1838,7 @@ static void velocity_free_tx_buf(struct velocity_info *vptr, struct velocity_td_
>  {
>  	struct sk_buff *skb = tdinfo->skb;
>  	int i;
> +	int pktlen;
>  
>  	/*
>  	 *	Don't unmap the pre-allocated tx_bufs
> @@ -1845,10 +1846,11 @@ static void velocity_free_tx_buf(struct velocity_info *vptr, struct velocity_td_
>  	if (tdinfo->skb_dma) {
>  
> +		pktlen = (skb->len > ETH_ZLEN ? : ETH_ZLEN);

I personally find better to use max(skb->len, ETH_ZLEN) macro, but YMMV ;)

It actually can avoid you a bug ;)


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html