lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20231105-gemini-largeframe-fix-v2-3-cd3a5aa6c496@linaro.org> Date: Sun, 05 Nov 2023 21:57:25 +0100 From: Linus Walleij <linus.walleij@...aro.org> To: Hans Ulli Kroll <ulli.kroll@...glemail.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Michał Mirosław <mirq-linux@...e.qmqm.pl>, Vladimir Oltean <olteanv@...il.com>, Andrew Lunn <andrew@...n.ch> Cc: linux-arm-kernel@...ts.infradead.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, Linus Walleij <linus.walleij@...aro.org> Subject: [PATCH net v2 3/4] net: ethernet: cortina: Protect against oversized frames The max size of a transfer no matter the MTU is 64KB-1 so immediately bail out if the skb exceeds that. The calling site tries to linearize the skbuff on error so return a special error code -E2BIG to indicate that this will not work in any way and bail out immediately if this happens. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Signed-off-by: Linus Walleij <linus.walleij@...aro.org> --- drivers/net/ethernet/cortina/gemini.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c index b21a94b4ab5c..576174a862a9 100644 --- a/drivers/net/ethernet/cortina/gemini.c +++ b/drivers/net/ethernet/cortina/gemini.c @@ -1151,6 +1151,12 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, if (skb->protocol == htons(ETH_P_8021Q)) mtu += VLAN_HLEN; + if (skb->len > 65535) { + /* The field for length is only 16 bits */ + netdev_err(netdev, "%s: frame too big, max size 65535 bytes\n", __func__); + return -E2BIG; + } + word1 = skb->len; word3 = SOF_BIT; @@ -1232,6 +1238,7 @@ static netdev_tx_t gmac_start_xmit(struct sk_buff *skb, struct gmac_txq *txq; int txq_num, nfrags; union dma_rwptr rw; + int ret; if (skb->len >= 0x10000) goto out_drop_free; @@ -1269,7 +1276,11 @@ static netdev_tx_t gmac_start_xmit(struct sk_buff *skb, } } - if (gmac_map_tx_bufs(netdev, skb, txq, &w)) { + ret = gmac_map_tx_bufs(netdev, skb, txq, &w); + if (ret == -E2BIG) + goto out_drop; + if (ret) { + /* Linearize and retry */ if (skb_linearize(skb)) goto out_drop; -- 2.34.1
Powered by blists - more mailing lists