netdev - Re: [PATCH net] r8169: Fix possible ring buffer corruption on fragmented Tx packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 22 May 2024 00:07:10 +0200
From: Heiner Kallweit <hkallweit1@...il.com>
To: Ken Milmore <ken.milmore@...il.com>,
 "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Cc: Realtek linux nic maintainers <nic_swsd@...ltek.com>
Subject: Re: [PATCH net] r8169: Fix possible ring buffer corruption on
 fragmented Tx packets

On 21.05.2024 23:20, Ken Milmore wrote:
> An issue was found on the RTL8125b when transmitting small fragmented
> packets, whereby invalid entries were inserted into the transmit ring
> buffer, subsequently leading to calls to dma_unmap_single() with a null
> address.
> 
> This was caused by rtl8169_start_xmit() not noticing changes to nr_frags
> which may occur when small packets are padded (to work around hardware
> quirks) in rtl8169_tso_csum_v2().
> 
> To fix this, postpone inspecting nr_frags until after any padding has been
> applied.
> 
> Fixes: 9020845fb5d6 ("r8169: improve rtl8169_start_xmit")

Meanwhile also netdev fixes should have the following:
CC: stable@...r.kernel.org
See https://www.kernel.org/doc/Documentation/process/stable-kernel-rules.rst

> Signed-off-by: Ken Milmore <ken.milmore@...il.com>
> ---
>  drivers/net/ethernet/realtek/r8169_main.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
> index 86a6d4225bc..86ed9189d5f 100644
> --- a/drivers/net/ethernet/realtek/r8169_main.c
> +++ b/drivers/net/ethernet/realtek/r8169_main.c
> @@ -4337,12 +4337,12 @@ static void rtl8169_doorbell(struct rtl8169_private *tp)
>  static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
>  				      struct net_device *dev)
>  {
> -	unsigned int frags = skb_shinfo(skb)->nr_frags;
>  	struct rtl8169_private *tp = netdev_priv(dev);
>  	unsigned int entry = tp->cur_tx % NUM_TX_DESC;
>  	struct TxDesc *txd_first, *txd_last;
>  	bool stop_queue, door_bell;
>  	u32 opts[2];
> +	unsigned int frags;
>  
netdev wants reverse xmas tree.

>  	if (unlikely(!rtl_tx_slots_avail(tp))) {
>  		if (net_ratelimit())
> @@ -4364,6 +4364,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
>  
>  	txd_first = tp->TxDescArray + entry;
>  
> +	frags = skb_shinfo(skb)->nr_frags;
>  	if (frags) {
>  		if (rtl8169_xmit_frags(tp, skb, opts, entry))
>  			goto err_dma_1;

Run get_maintainers.pl. The netdev subsystem maintainers are missing.

Apart from that lgtm.