lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 15 Nov 2014 10:21:35 -0800 From: Eric Dumazet <eric.dumazet@...il.com> To: Jeff Kirsher <jeffrey.t.kirsher@...el.com> Cc: davem@...emloft.net, Serey Kong <serey.kong@...el.com>, netdev@...r.kernel.org, nhorman@...hat.com, sassmann@...hat.com, jogreene@...hat.com, Shannon Nelson <shannon.nelson@...el.com> Subject: Re: [net-next 03/12] i40e: Handle a single mss packet with more than 8 frags On Fri, 2014-11-14 at 22:08 -0800, Jeff Kirsher wrote: > From: Serey Kong <serey.kong@...el.com> > > This handles the case where a single packet with more than 8 data > descriptors triggers a Malicious Driver Detect event in the device. > > Change-ID: I2bfd657fd036bed616863e121f6aa86a35d2194c > Signed-off-by: Serey Kong <serey.kong@...el.com> > Signed-off-by: Shannon Nelson <shannon.nelson@...el.com> > Tested-by: Jim Young <jamesx.m.young@...el.com> > Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@...el.com> > --- > drivers/net/ethernet/intel/i40e/i40e_txrx.c | 14 ++++++++++---- > drivers/net/ethernet/intel/i40e/i40e_txrx.h | 1 + > drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 14 ++++++++++---- > drivers/net/ethernet/intel/i40evf/i40e_txrx.h | 1 + > 4 files changed, 22 insertions(+), 8 deletions(-) > > diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c > index 3195d82..9731026 100644 > --- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c > +++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c > @@ -2113,12 +2113,12 @@ static void i40e_tx_map(struct i40e_ring *tx_ring, struct sk_buff *skb, > const u8 hdr_len, u32 td_cmd, u32 td_offset) > #endif > { > - unsigned int data_len = skb->data_len; > - unsigned int size = skb_headlen(skb); > struct skb_frag_struct *frag; > struct i40e_tx_buffer *tx_bi; > struct i40e_tx_desc *tx_desc; > u16 i = tx_ring->next_to_use; > + unsigned int data_len; > + unsigned int size; > u32 td_tag = 0; > dma_addr_t dma; > u16 gso_segs; > @@ -2129,10 +2129,16 @@ static void i40e_tx_map(struct i40e_ring *tx_ring, struct sk_buff *skb, > I40E_TX_FLAGS_VLAN_SHIFT; > } > > - if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO)) > + if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO)) { > gso_segs = skb_shinfo(skb)->gso_segs; > - else > + } else { > gso_segs = 1; > + if (skb_shinfo(skb)->nr_frags >= I40E_MAX_BUFFER_TXD) > + skb_linearize(skb); What exactly happens if skb_linearize() fails ? Is this "Malicious Driver Detect event" fatal or simply packet is dropped without additional harm ? -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists