netdev - usbnet: ipheth: fix EOVERFLOW in ipheth_rcvbulk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 16 Apr 2021 21:13:40 +0300
From:   Georgi Valkov <gvalkov@....bg>
To:     corsac@...sac.net, netdev@...r.kernel.org,
        linux-usb@...r.kernel.org
Cc:     oneukum@...e.com, matti.vuorela@...factor.fi
Subject: usbnet: ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback

Dear Linux kernel team,

Please accept the following important fix from me:
https://github.com/httpstorm/linux-kernel/tree/ipheth-fix-RX-EOVERFLOW

While commit f33d9e2b48a34e1558b67a473a1fc1d6e793f93c
is required for iOS 14, only the TX buffers should be reduced
to 1514 bytes. RX buffers should remain at 1516 bytes, because
their size is reduced later by IPHETH_IP_ALIGN (2 bytes).


From dd109ded2b526636fff438d33433ab64ffd21583 Mon Sep 17 00:00:00 2001
From: Georgi Valkov <gvalkov@....bg>
Date: Fri, 16 Apr 2021 20:44:36 +0300
Subject: [PATCH] usbnet: ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback

When rx_buf is allocated we need to account for IPHETH_IP_ALIGN,
which reduces the usable size by 2 bytes. Otherwise we have 1512
bytes usable instead of 1514, and if we receive more than 1512
bytes, ipheth_rcvbulk_callback is called with status -EOVERFLOW,
after which the driver malfunctiones and all communication stops.

Fixes: ipheth 2-1:4.2: ipheth_rcvbulk_callback: urb status: -75

Signed-off-by: Georgi Valkov <gvalkov@....bg>
---
 drivers/net/usb/ipheth.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 207e59e74935..06d9f19ca142 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -121,7 +121,7 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
 	if (tx_buf == NULL)
 		goto free_rx_urb;
 
-	rx_buf = usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE,
+	rx_buf = usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN,
 				    GFP_KERNEL, &rx_urb->transfer_dma);
 	if (rx_buf == NULL)
 		goto free_tx_buf;
@@ -146,7 +146,7 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
 
 static void ipheth_free_urbs(struct ipheth_device *iphone)
 {
-	usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
+	usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, iphone->rx_buf,
 			  iphone->rx_urb->transfer_dma);
 	usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
 			  iphone->tx_urb->transfer_dma);
@@ -317,7 +317,7 @@ static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
 
 	usb_fill_bulk_urb(dev->rx_urb, udev,
 			  usb_rcvbulkpipe(udev, dev->bulk_in),
-			  dev->rx_buf, IPHETH_BUF_SIZE,
+			  dev->rx_buf, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN,
 			  ipheth_rcvbulk_callback,
 			  dev);
 	dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
-- 
2.31.1