netdev - Re: [PATCH 1/3] net: macb: fix random memory corruption on RX with 64-bit DMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Dec 2018 10:14:04 +0530
From:   Harini Katakam <harinik@...inx.com>
To:     anssi.hannula@...wise.fi
Cc:     Nicolas Ferre <nicolas.ferre@...rochip.com>,
        David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
        Harini Katakam <harini.katakam@...inx.com>,
        Michal Simek <michal.simek@...inx.com>
Subject: Re: [PATCH 1/3] net: macb: fix random memory corruption on RX with
 64-bit DMA

On Fri, Nov 30, 2018 at 11:53 PM Anssi Hannula <anssi.hannula@...wise.fi> wrote:
>
> 64-bit DMA addresses are split in upper and lower halves that are
> written in separate fields on GEM. For RX, bit 0 of the address is used
> as the ownership bit (RX_USED). When the RX_USED bit is unset the
> controller is allowed to write data to the buffer.
>
> The driver does not guarantee that the controller already sees the upper
> half when the RX_USED bit is cleared, possibly resulting in the
> controller writing an incoming frame to an address with an incorrect
> upper half and therefore possibly corrupting unrelated system memory.
>
> Fix that by adding the necessary DMA memory barrier between the writes.
>
> This corruption was observed on a ZynqMP based system.
>
> Signed-off-by: Anssi Hannula <anssi.hannula@...wise.fi>
> Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM")
> Cc: Nicolas Ferre <nicolas.ferre@...rochip.com>
> Cc: Harini Katakam <harini.katakam@...inx.com>
> Cc: Michal Simek <michal.simek@...inx.com>

Acked-by: Harini Katakam <harini.katakam@...inx.com>

Regards,
Harini