From patchwork Mon Jan 20 11:13:14 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jonas Jensen X-Patchwork-Id: 3511661 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 5BBEBC02DC for ; Mon, 20 Jan 2014 11:21:43 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 81A382015D for ; Mon, 20 Jan 2014 11:21:42 +0000 (UTC) Received: from casper.infradead.org (casper.infradead.org [85.118.1.10]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5EEE32010E for ; Mon, 20 Jan 2014 11:21:41 +0000 (UTC) Received: from merlin.infradead.org ([2001:4978:20e::2]) by casper.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1W5Cut-0007wY-Q6; Mon, 20 Jan 2014 11:21:19 +0000 Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1W5Cuj-0002Jq-Pk; Mon, 20 Jan 2014 11:21:09 +0000 Received: from mail-lb0-x234.google.com ([2a00:1450:4010:c04::234]) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1W5Cug-0002IM-P2 for linux-arm-kernel@lists.infradead.org; Mon, 20 Jan 2014 11:21:07 +0000 Received: by mail-lb0-f180.google.com with SMTP id n15so4680110lbi.25 for ; Mon, 20 Jan 2014 03:20:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=1h3El3QzihaVG175EFThUsmVJdAp2xX6LS4gagvAEsI=; b=ay1e6xLC8p+OuD/+85CwoWdXioe81peW9lT1pZfetntITInYbR3z3dyD1shP/6uqsP pNKiYFQOL8VqfFD5zHwKvr3IF97it6QAsjemOoBQRnu0e8JosrSWcqtM2y6Ii666oSwY R1PKtMJTZZbHGwcMKMiplrh/cYyBxIp6Tb45TWKkmMYKX7+3JocLWqtPi83cm0vtOp1c ZRlFAu4E1PhUP5UvdF67D8VIBeDz3yPn+zF5THeIUJGUNV/KQSwvMv3+QyJpoYtPxizw ogfa0j4PVBe3HYcxRaK0iQAou0ErEfAh3hbkIM1Odtq5oJcVfjlvHGBl/rHpoFfJncFL CPhA== X-Received: by 10.112.172.69 with SMTP id ba5mr597599lbc.55.1390216433424; Mon, 20 Jan 2014 03:13:53 -0800 (PST) Received: from Ildjarn.ath.cx (static-213-115-41-10.sme.bredbandsbolaget.se. [213.115.41.10]) by mx.google.com with ESMTPSA id sv5sm551815lbb.9.2014.01.20.03.13.51 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 20 Jan 2014 03:13:52 -0800 (PST) From: Jonas Jensen To: netdev@vger.kernel.org Subject: [PATCH v3 2/7] net: moxa: fix build_skb() memory corruption Date: Mon, 20 Jan 2014 12:13:14 +0100 Message-Id: <1390216399-27028-2-git-send-email-jonas.jensen@gmail.com> X-Mailer: git-send-email 1.8.2.1 In-Reply-To: <1390216399-27028-1-git-send-email-jonas.jensen@gmail.com> References: <1390216399-27028-1-git-send-email-jonas.jensen@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20140120_062106_969803_98239DD2 X-CRM114-Status: GOOD ( 10.60 ) X-Spam-Score: -2.0 (--) Cc: f.fainelli@gmail.com, linux-kernel@vger.kernel.org, Jonas Jensen , bhutchings@solarflare.com, davem@davemloft.net, linux-arm-kernel@lists.infradead.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-4.6 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP DMA buffer memory must be synchronized and copied before passing skb to napi_gro_receive(). The use of build_skb() can lead to memory corruption, replace it with netdev_alloc_skb_ip_align() and memcpy(). Addresses https://bugzilla.kernel.org/show_bug.cgi?id=69041 Signed-off-by: Jonas Jensen --- Notes: This fixes the following error on wget download (or ncftp), usually after only a few seconds: "read error: Bad address" On receiving this error, wget exits. The download is not resumed (busybox default). Applies to next-20140120 drivers/net/ethernet/moxa/moxart_ether.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c index aa45607..17c9f0e 100644 --- a/drivers/net/ethernet/moxa/moxart_ether.c +++ b/drivers/net/ethernet/moxa/moxart_ether.c @@ -226,14 +226,21 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget) if (len > RX_BUF_SIZE) len = RX_BUF_SIZE; - skb = build_skb(priv->rx_buf[rx_head], priv->rx_buf_size); + dma_sync_single_for_cpu(&ndev->dev, + priv->rx_mapping[rx_head], + priv->rx_buf_size, DMA_FROM_DEVICE); + skb = netdev_alloc_skb_ip_align(ndev, len); if (unlikely(!skb)) { - net_dbg_ratelimited("build_skb failed\n"); + net_dbg_ratelimited("netdev_alloc_skb_ip_align failed\n"); priv->stats.rx_dropped++; priv->stats.rx_errors++; } - + memcpy(skb->data, priv->rx_buf[rx_head], len); skb_put(skb, len); + dma_sync_single_for_device(&ndev->dev, + priv->rx_mapping[rx_head], + priv->rx_buf_size, DMA_FROM_DEVICE); + skb->protocol = eth_type_trans(skb, ndev); napi_gro_receive(&priv->napi, skb); rx++;