From patchwork Sun Nov 5 20:57:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Linus Walleij X-Patchwork-Id: 13446147 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 765A0C4167D for ; Sun, 5 Nov 2023 20:58:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References:Message-Id :MIME-Version:Subject:Date:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=fUrCiyIYfdz6pt1/UCuvijoOMg3Lb81tK1tXjnVvIdo=; b=YePe4YSGioPra4 PmwRjAZpv61uZZkIevdTRC+OkG3mb2XdWFZAELI+gZZWaa7oqFQZbhZYjCzAJeEzfArN6uXaPKO8Z mvbytvKGyfc5nuCdxidyicbsihCmn2dw9ixgrWjOQuiGomi2rX0xSsIMRpfP/5fVV4FyU95wdstnU oZAbj1tAs2rXX2H4piWaIfmMCFu5oL/llZVvs88nqvPDtwudl2CdpFWoCWWPxYe/vDS///Vin1jVW 8i3ygGxNwkjfPYLHIROpVuD7UlpGz1Tkp8Z9nPazPo2bqpiySeBYRQlLjref3EzEUS2GlRGk3CKYn Iregybet1dYZUm338X6g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qzkBe-00FVyp-0G; Sun, 05 Nov 2023 20:57:38 +0000 Received: from mail-lf1-x135.google.com ([2a00:1450:4864:20::135]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qzkBa-00FVvC-0P for linux-arm-kernel@lists.infradead.org; Sun, 05 Nov 2023 20:57:35 +0000 Received: by mail-lf1-x135.google.com with SMTP id 2adb3069b0e04-507a0907896so4791158e87.2 for ; Sun, 05 Nov 2023 12:57:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1699217850; x=1699822650; darn=lists.infradead.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=hHGg7IgOG8aP3eorgAYgy9MJBjBd5UgvuR9R9eWvihw=; b=qDLnU3uJpkNTPCLHT+6xEp1x/HYoAErTGxuyXPNBfcWqaJiPnVaSeeWloDBfykgJ5b 0BZG7VlyIB0CxxWKZcWMDw6cI7e7TB6V0Tk39yJhttYlpUs1V3ABOW9DNq4lxm8xPUO4 pbZ0ESw+VrA+Gm6hx/ZI6m42VPKXDXjcYBFQf5JhyiRniD3Hf8qwCJNtAv0kg69e2V76 OWO3SRNzMamdzSyfmI9TN3CjXkncJjNwn5v2mHNvA8BSY5s6svdhRm1w56NcFGTAc3oV YAoJV9Taa4yjUWiDNCTF6a9UnqK/NOOlnEg1elhufOAq4360xQ1vPulWif3usxFaWwEI cYFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1699217850; x=1699822650; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=hHGg7IgOG8aP3eorgAYgy9MJBjBd5UgvuR9R9eWvihw=; b=NkfYYc+Xc13iyJUt0j+NKJW3Ib9/1VgQqCAAKRnlh8/9Ck+3zw/d5UsMr2ufSBYlLr 38MhvxcOWBXhDkAwdvjgvHypQvY3Nw72fxwFEMlu7A/Fx6qcunxWIKKoAe22Dol6VxUY AiCktuk2uFRi56sRXYVjWXSfMBDQYr7kFSiioP4uxtGnghAKxtgKeVyfAxgeN/Ul7bWg 2ULC1Fao/jeLfjpU3zOr0foQhozBHATWY6ICFEHwj5B84hHAvHaLDradB0XS9ozMSpOv 8bguqegro9wKtkl0Hh+bF7/WHb7bNwrAQ+OfN9CT4Hc6DUnbw2+fIj1bUNeKDP8v7GEw TzWA== X-Gm-Message-State: AOJu0Yy7/xxB3RQK86eRDWTGRUXkB0Wf3kZKYsbd7N1mskb/HkK3cwgE iSHS87Ij4UbqS6oQ0VIjs8Qp4g== X-Google-Smtp-Source: AGHT+IF7W3TbvSvzphWkJ38I4V5LXCkTCcll16Xd2nGcrFIOQF+dFaXj5XAglJ+flcNEhVosFX81xQ== X-Received: by 2002:a05:6512:368f:b0:506:8d2a:5654 with SMTP id d15-20020a056512368f00b005068d2a5654mr17718911lfs.28.1699217850484; Sun, 05 Nov 2023 12:57:30 -0800 (PST) Received: from [127.0.1.1] ([85.235.12.238]) by smtp.gmail.com with ESMTPSA id d12-20020ac24c8c000000b00507c72697d0sm931873lfl.303.2023.11.05.12.57.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 05 Nov 2023 12:57:30 -0800 (PST) From: Linus Walleij Date: Sun, 05 Nov 2023 21:57:25 +0100 Subject: [PATCH net v2 3/4] net: ethernet: cortina: Protect against oversized frames MIME-Version: 1.0 Message-Id: <20231105-gemini-largeframe-fix-v2-3-cd3a5aa6c496@linaro.org> References: <20231105-gemini-largeframe-fix-v2-0-cd3a5aa6c496@linaro.org> In-Reply-To: <20231105-gemini-largeframe-fix-v2-0-cd3a5aa6c496@linaro.org> To: Hans Ulli Kroll , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , =?utf-8?b?TWljaGHFgiBNaXJvc8WCYXc=?= , Vladimir Oltean , Andrew Lunn Cc: linux-arm-kernel@lists.infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Linus Walleij X-Mailer: b4 0.12.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231105_125734_165971_ABB3DF68 X-CRM114-Status: GOOD ( 15.24 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The max size of a transfer no matter the MTU is 64KB-1 so immediately bail out if the skb exceeds that. The calling site tries to linearize the skbuff on error so return a special error code -E2BIG to indicate that this will not work in any way and bail out immediately if this happens. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Signed-off-by: Linus Walleij --- drivers/net/ethernet/cortina/gemini.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c index b21a94b4ab5c..576174a862a9 100644 --- a/drivers/net/ethernet/cortina/gemini.c +++ b/drivers/net/ethernet/cortina/gemini.c @@ -1151,6 +1151,12 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, if (skb->protocol == htons(ETH_P_8021Q)) mtu += VLAN_HLEN; + if (skb->len > 65535) { + /* The field for length is only 16 bits */ + netdev_err(netdev, "%s: frame too big, max size 65535 bytes\n", __func__); + return -E2BIG; + } + word1 = skb->len; word3 = SOF_BIT; @@ -1232,6 +1238,7 @@ static netdev_tx_t gmac_start_xmit(struct sk_buff *skb, struct gmac_txq *txq; int txq_num, nfrags; union dma_rwptr rw; + int ret; if (skb->len >= 0x10000) goto out_drop_free; @@ -1269,7 +1276,11 @@ static netdev_tx_t gmac_start_xmit(struct sk_buff *skb, } } - if (gmac_map_tx_bufs(netdev, skb, txq, &w)) { + ret = gmac_map_tx_bufs(netdev, skb, txq, &w); + if (ret == -E2BIG) + goto out_drop; + if (ret) { + /* Linearize and retry */ if (skb_linearize(skb)) goto out_drop;