Skip to contentSkip to conversation

Patch "net: xilinx_emaclite: fix receive buffer overflow" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Jun 15, 2017

Subsystems (3)
Network drivers Stable branch Arm/Zynq architecture
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

net: xilinx_emaclite: fix receive buffer overflow

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-xilinx_emaclite-fix-receive-buffer-overflow.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Thu Jun 15 09:31:48 CEST 2017

From: Anssi Hannula <[email protected]>
Date: Tue, 23 May 2017 21:53:29 -0400
Subject: net: xilinx_emaclite: fix receive buffer overflow

From: Anssi Hannula <[email protected]>

[ Upstream commit cd224553641848dd17800fe559e4ff5d208553e8 ]

xilinx_emaclite looks at the received data to try to determine the Ethernet packet length but does not properly clamp it if proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer overflow and a panic via skb_panic() as the length exceeds the allocated skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by Anssi Hannula <[email protected]>
Fixes bb81b2ddfa19 ("net: add Xilinx emac lite device driver")
Signed-off-by David S. Miller <[email protected]>
Signed-off-by Sasha Levin <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/net/ethernet/xilinx/xilinx_emaclite.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/xilinx/xilinx_emaclite.c +7 -3
@@ -377,7 +377,7 @@ static int xemaclite_send_data(struct ne
  *
  * Return:	Total number of bytes received
  */
-static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data)
+static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
 {
 	void __iomem *addr;
 	u16 length, proto_type;

@@ -417,7 +417,7 @@ static u16 xemaclite_recv_data(struct ne
 
 	/* Check if received ethernet frame is a raw ethernet frame
 	 * or an IP packet or an ARP packet */
-	if (proto_type > (ETH_FRAME_LEN + ETH_FCS_LEN)) {
+	if (proto_type > ETH_DATA_LEN) {
 
 		if (proto_type == ETH_P_IP) {
 			length = ((ntohl(xemaclite_readl(addr +

@@ -425,6 +425,7 @@ static u16 xemaclite_recv_data(struct ne
 					XEL_RXBUFF_OFFSET)) >>
 					XEL_HEADER_SHIFT) &
 					XEL_RPLR_LENGTH_MASK);
+			length = min_t(u16, length, ETH_DATA_LEN);
 			length += ETH_HLEN + ETH_FCS_LEN;
 
 		} else if (proto_type == ETH_P_ARP)

@@ -437,6 +438,9 @@ static u16 xemaclite_recv_data(struct ne
 		/* Use the length in the frame, plus the header and trailer */
 		length = proto_type + ETH_HLEN + ETH_FCS_LEN;
 
+	if (WARN_ON(length > maxlen))
+		length = maxlen;
+
 	/* Read from the EmacLite device */
 	xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET),
 				data, length);

@@ -611,7 +615,7 @@ static void xemaclite_rx_handler(struct
 
 	skb_reserve(skb, 2);
 
-	len = xemaclite_recv_data(lp, (u8 *) skb->data);
+	len = xemaclite_recv_data(lp, (u8 *) skb->data, len);
 
 	if (!len) {
 		dev->stats.rx_errors++;

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/net-xilinx_emaclite-fix-freezes-due-to-unordered-i-o.patch queue-4.9/net-xilinx_emaclite-fix-receive-buffer-overflow.patch