| Message ID | 20240713223357.2911169-1-olek2@wp.pl (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: ethernet: lantiq_etop: fix memory disclosure | expand |
On 7/14/24 00:33, Aleksander Jan Bajkowski wrote: > diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c > index 0b9982804370..196715d9ea43 100644 > --- a/drivers/net/ethernet/lantiq_etop.c > +++ b/drivers/net/ethernet/lantiq_etop.c > @@ -478,11 +478,11 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev) > struct ltq_etop_priv *priv = netdev_priv(dev); > struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1]; > struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc]; > - int len; > unsigned long flags; > u32 byte_offset; > > - len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len; > + if (skb_put_padto(skb, ETH_ZLEN)) You may want to increment tx drop stats here. Thanks, Paolo
Hi Paolo, On 16.07.2024 11:46, Paolo Abeni wrote: > On 7/14/24 00:33, Aleksander Jan Bajkowski wrote: >> diff --git a/drivers/net/ethernet/lantiq_etop.c >> b/drivers/net/ethernet/lantiq_etop.c >> index 0b9982804370..196715d9ea43 100644 >> --- a/drivers/net/ethernet/lantiq_etop.c >> +++ b/drivers/net/ethernet/lantiq_etop.c >> @@ -478,11 +478,11 @@ ltq_etop_tx(struct sk_buff *skb, struct >> net_device *dev) >> struct ltq_etop_priv *priv = netdev_priv(dev); >> struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1]; >> struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc]; >> - int len; >> unsigned long flags; >> u32 byte_offset; >> - len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len; >> + if (skb_put_padto(skb, ETH_ZLEN)) > > You may want to increment tx drop stats here. Statistics are on my TODO list. The current version of this driver does not support statistics, so I will add them then. I would first prefer to fix all the bugs present in the current version of the driver and then add new features. > > Thanks, > > Paolo > Best regards, Aleksander
On 16.07.2024 21:27, Aleksander Jan Bajkowski wrote: > Hi Paolo, > > On 16.07.2024 11:46, Paolo Abeni wrote: >> On 7/14/24 00:33, Aleksander Jan Bajkowski wrote: >>> diff --git a/drivers/net/ethernet/lantiq_etop.c >>> b/drivers/net/ethernet/lantiq_etop.c >>> index 0b9982804370..196715d9ea43 100644 >>> --- a/drivers/net/ethernet/lantiq_etop.c >>> +++ b/drivers/net/ethernet/lantiq_etop.c >>> @@ -478,11 +478,11 @@ ltq_etop_tx(struct sk_buff *skb, struct >>> net_device *dev) >>> struct ltq_etop_priv *priv = netdev_priv(dev); >>> struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1]; >>> struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc]; >>> - int len; >>> unsigned long flags; >>> u32 byte_offset; >>> - len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len; >>> + if (skb_put_padto(skb, ETH_ZLEN)) >> >> You may want to increment tx drop stats here. > > Statistics are on my TODO list. The current version of this driver > does not support statistics, so I will add them then. I would first > prefer to fix all the bugs present in the current version of the driver > and then add new features. Can this patch be merged? With the current form, it should be easy to backport. I will add statistics to this driver in the future. I think it doesn't make sense to increment only one statistic of dropped packets. > > >> >> Thanks, >> >> Paolo >> > Best regards, > Aleksander > >
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c index 0b9982804370..196715d9ea43 100644 --- a/drivers/net/ethernet/lantiq_etop.c +++ b/drivers/net/ethernet/lantiq_etop.c @@ -478,11 +478,11 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev) struct ltq_etop_priv *priv = netdev_priv(dev); struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1]; struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc]; - int len; unsigned long flags; u32 byte_offset; - len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len; + if (skb_put_padto(skb, ETH_ZLEN)) + return NETDEV_TX_OK; if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) { netdev_err(dev, "tx ring full\n"); @@ -497,12 +497,13 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev) netif_trans_update(dev); spin_lock_irqsave(&priv->lock, flags); - desc->addr = ((unsigned int)dma_map_single(&priv->pdev->dev, skb->data, len, - DMA_TO_DEVICE)) - byte_offset; + desc->addr = ((unsigned int)dma_map_single(&priv->pdev->dev, skb->data, + skb->len, DMA_TO_DEVICE)) - + byte_offset; /* Make sure the address is written before we give it to HW */ wmb(); desc->ctl = LTQ_DMA_OWN | LTQ_DMA_SOP | LTQ_DMA_EOP | - LTQ_DMA_TX_OFFSET(byte_offset) | (len & LTQ_DMA_SIZE_MASK); + LTQ_DMA_TX_OFFSET(byte_offset) | (skb->len & LTQ_DMA_SIZE_MASK); ch->dma.desc++; ch->dma.desc %= LTQ_DESC_NUM; spin_unlock_irqrestore(&priv->lock, flags);
When applying padding, the buffer is not zeroed, which results in memory disclosure. This patch uses skb_put_padto() to pad Ethernet frames properly. It appears that only the MAC in xrx100 and newer SoCs supports padding by hardware, so software padding must be applied. Fixes: 504d4721ee8e ("MIPS: Lantiq: Add ethernet driver") Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> --- drivers/net/ethernet/lantiq_etop.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)