lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 19 Oct 2020 16:57:14 +0800 From: Dylan Hung <dylan_hung@...eedtech.com> To: <davem@...emloft.net>, <kuba@...nel.org>, <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>, <ratbert@...aday-tech.com>, <linux-aspeed@...ts.ozlabs.org>, <openbmc@...ts.ozlabs.org> CC: <BMC-SW@...eedtech.com>, Joel Stanley <joel@....id.au> Subject: [PATCH 1/4] ftgmac100: Fix race issue on TX descriptor[0] These rules must be followed when accessing the TX descriptor: 1. A TX descriptor is "cleanable" only when its value is non-zero and the owner bit is set to "software" 2. A TX descriptor is "writable" only when its value is zero regardless the edotr mask. Fixes: 52c0cae87465 ("ftgmac100: Remove tx descriptor accessors") Signed-off-by: Dylan Hung <dylan_hung@...eedtech.com> Signed-off-by: Joel Stanley <joel@....id.au> --- drivers/net/ethernet/faraday/ftgmac100.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c index 00024dd41147..7cacbe4aecb7 100644 --- a/drivers/net/ethernet/faraday/ftgmac100.c +++ b/drivers/net/ethernet/faraday/ftgmac100.c @@ -647,6 +647,9 @@ static bool ftgmac100_tx_complete_packet(struct ftgmac100 *priv) if (ctl_stat & FTGMAC100_TXDES0_TXDMA_OWN) return false; + if ((ctl_stat & ~(priv->txdes0_edotr_mask)) == 0) + return false; + skb = priv->tx_skbs[pointer]; netdev->stats.tx_packets++; netdev->stats.tx_bytes += skb->len; @@ -756,6 +759,9 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, pointer = priv->tx_pointer; txdes = first = &priv->txdes[pointer]; + if (le32_to_cpu(txdes->txdes0) & ~priv->txdes0_edotr_mask) + goto drop; + /* Setup it up with the packet head. Don't write the head to the * ring just yet */ @@ -787,6 +793,10 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb, /* Setup descriptor */ priv->tx_skbs[pointer] = skb; txdes = &priv->txdes[pointer]; + + if (le32_to_cpu(txdes->txdes0) & ~priv->txdes0_edotr_mask) + goto dma_err; + ctl_stat = ftgmac100_base_tx_ctlstat(priv, pointer); ctl_stat |= FTGMAC100_TXDES0_TXDMA_OWN; ctl_stat |= FTGMAC100_TXDES0_TXBUF_SIZE(len); -- 2.17.1
Powered by blists - more mailing lists