| Message ID | 20240910143144.1439910-1-sean.anderson@linux.dev (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v2] net: dpaa: Pad packets to ETH_ZLEN | expand |
On Tue, Sep 10, 2024 at 4:32 PM Sean Anderson <sean.anderson@linux.dev> wrote: > > When sending packets under 60 bytes, up to three bytes of the buffer > following the data may be leaked. Avoid this by extending all packets to > ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be > reproduced by running > > $ ping -s 11 destination > > Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") > Suggested-by: Eric Dumazet <edumazet@google.com> > Signed-off-by: Sean Anderson <sean.anderson@linux.dev> Reviewed-by: Eric Dumazet <edumazet@google.com> Thanks !
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Tue, 10 Sep 2024 10:31:44 -0400 you wrote: > When sending packets under 60 bytes, up to three bytes of the buffer > following the data may be leaked. Avoid this by extending all packets to > ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be > reproduced by running > > $ ping -s 11 destination > > [...] Here is the summary with links: - [net,v2] net: dpaa: Pad packets to ETH_ZLEN https://git.kernel.org/netdev/net/c/cbd7ec083413 You are awesome, thank you!
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index cfe6b57b1da0..4a55e521c17e 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2272,12 +2272,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); - bool nonlinear = skb_is_nonlinear(skb); struct rtnl_link_stats64 *percpu_stats; struct dpaa_percpu_priv *percpu_priv; struct netdev_queue *txq; struct dpaa_priv *priv; struct qm_fd fd; + bool nonlinear; int offset = 0; int err = 0; @@ -2287,6 +2287,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) qm_fd_clear_fd(&fd); + /* Packet data is always read as 32-bit words, so zero out any part of + * the skb which might be sent if we have to pad the packet + */ + if (__skb_put_padto(skb, ETH_ZLEN, false)) + goto enomem; + + nonlinear = skb_is_nonlinear(skb); if (!nonlinear) { /* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb
When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Sean Anderson <sean.anderson@linux.dev> --- Changes in v2: - Fix the nonlinear varable becoming out-of-sync with the skb's linearization state by padding the packet before anything else. drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)