Received: by 10.213.65.68 with SMTP id h4csp2122028imn; Sun, 8 Apr 2018 20:14:45 -0700 (PDT) X-Google-Smtp-Source: AIpwx48eIO1Sv2PabvaNNxx3aCcniO4d+YxNCXggn3F6r62Y1lvGybhgLju5DlUfoxSH4LgMUZdQ X-Received: by 10.101.72.68 with SMTP id i4mr2931078pgs.265.1523243685242; Sun, 08 Apr 2018 20:14:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523243685; cv=none; d=google.com; s=arc-20160816; b=xwD4G+e3aAAOCrjvdLuPrax1Z1ZmgPNVGNF282e9dydrnEKrJUR9gPmYri+ZupmHes QHxa1Q/IqmX3DEvQAMq1FvYgGYxaYtTKgf+bctMcOpfjRpBcFJLt3R3cU1m4DlFpyokk cmyMIjgnTiJ/XJgx0MfHRT9sbJBVq0HWNsc4FiHLu2kFjNWi7N8tw1LOGlVG2RXrxXT9 63QmaWV6gtvF4KyXhvKY768EtHsj+8GswmJ21hqTtlvs+MhK8GnoDfiEwnz7bCIMscMu 4gJQvh2bkcHUG0bT2GkNDBNiYWEPaLBQUFhT8WxCPyL6Hj1xy4VXe8mCZqG53mJye4p2 6XNQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:content-transfer-encoding :spamdiagnosticmetadata:spamdiagnosticoutput:content-language :accept-language:in-reply-to:references:message-id:date:thread-index :thread-topic:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=ynQjRCtn02SgZ6Y4sKpMZbj9uyTwC2zSxCFbk0h37vk=; b=MBPz2Zk9hC81nHzqOIeVGivjRCeZbi1QCBoJDUc2djjBP33AzOO7gCXZ5gLuD9hLa8 iusXaURNG235bOGZ8T0lEe+iWWYVRTJW69MYTXbYWYBQqwyqEkKeWtlxn7KDAPbKBNj7 EP+Aa6lBxOuxAogsphAVOMrBrJZSsaqiiCEYZ7T81t/Fop+3YXix8QNjmpqd//oExwqq r/uMl5/cUweu2xBJ2deoD0sDmZJnLD267Untz4aY7gA0bVDGWfE8DIvkgNVKItTANAp2 5LjIWoG2HXHXb+4VLwN9wYmp6wVmd9qbCK4sY6Y5nXCLtSFRqUL1UOKBMT0dE7Lc3u/G 9+pw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@microsoft.com header.s=selector1 header.b=PxocHlvV; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=microsoft.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a7si4656086pgc.797.2018.04.08.20.14.07; Sun, 08 Apr 2018 20:14:45 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@microsoft.com header.s=selector1 header.b=PxocHlvV; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=microsoft.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754342AbeDIDIz (ORCPT + 99 others); Sun, 8 Apr 2018 23:08:55 -0400 Received: from mail-by2nam03on0117.outbound.protection.outlook.com ([104.47.42.117]:63840 "EHLO NAM03-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932068AbeDIAYe (ORCPT ); Sun, 8 Apr 2018 20:24:34 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ynQjRCtn02SgZ6Y4sKpMZbj9uyTwC2zSxCFbk0h37vk=; b=PxocHlvVH1LVJyw5jZ/YfTiX167KDxnOOWsZVa8DKd3O+SXw6XFboj3Gpyf1x/n5PCvbLSdDxSurxYfi4u3ac7JGHTEEgGFdFBGpOQHwvMjG1Xxof4rnF2mFqAMWTr/2ooalUftiVXdglqrDCdIYVj5SlujxuIUnLbnqxYcsMgo= Received: from DM5PR2101MB1032.namprd21.prod.outlook.com (52.132.128.13) by DM5PR2101MB0984.namprd21.prod.outlook.com (52.132.133.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.696.0; Mon, 9 Apr 2018 00:24:30 +0000 Received: from DM5PR2101MB1032.namprd21.prod.outlook.com ([fe80::8109:aef0:a777:7059]) by DM5PR2101MB1032.namprd21.prod.outlook.com ([fe80::8109:aef0:a777:7059%2]) with mapi id 15.20.0696.003; Mon, 9 Apr 2018 00:24:30 +0000 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Andy Spencer , "David S . Miller" , Sasha Levin Subject: [PATCH AUTOSEL for 4.14 089/161] gianfar: prevent integer wrapping in the rx handler Thread-Topic: [PATCH AUTOSEL for 4.14 089/161] gianfar: prevent integer wrapping in the rx handler Thread-Index: AQHTz5iikHYdLvPwK06Al4mvZhcwkA== Date: Mon, 9 Apr 2018 00:20:59 +0000 Message-ID: <20180409001936.162706-89-alexander.levin@microsoft.com> References: <20180409001936.162706-1-alexander.levin@microsoft.com> In-Reply-To: <20180409001936.162706-1-alexander.levin@microsoft.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [52.168.54.252] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;DM5PR2101MB0984;7:qL5kcJFGP5HPBAxZ2JTArLRpy+qloA6/wDC+XxyvwAip89Iun6lTUjfd5LjxNjBarftPTcypxTDFt3eQrXKtszq+r/SzCC5XAgP2Mmkld9yoJBs3Km2PnaMh0s3TTStlj2yMD4Da8FmA1kl4qRBmBsB+YMdYgwuIMjPMojZ1JD6gNmNPOkiNYvh9I/nmZ702heIb/sWKkCTJrR95CmksPQYzQ2HSqSV57trJhQBDzTy9lwtLL4itzlU5RjtKkHAY;20:zMIIK+QCTY6Urz9FdhHjL/2+oK3SXxPTtXV0vmWi5xqXGk3YM/EelvjUSMuMu4tCjnAjVSmQcj1P4wb0TpqGF1ywRp5p3/uql6gTT+70dbOcLtMt8Cj/tcE4TYe3i1VNyia+CC7oXdX5ZkylYeK4u7mAVIdTefpxSV4clqISE9I= x-ms-office365-filtering-ht: Tenant X-MS-Office365-Filtering-Correlation-Id: 7da63497-9eee-4b58-208b-08d59db0430d x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(48565401081)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7193020);SRVR:DM5PR2101MB0984; x-ms-traffictypediagnostic: DM5PR2101MB0984: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alexander.Levin@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(89211679590171); x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(8211001083)(61425038)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231221)(944501327)(52105095)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041310)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123564045)(20161123560045)(6072148)(201708071742011);SRVR:DM5PR2101MB0984;BCL:0;PCL:0;RULEID:;SRVR:DM5PR2101MB0984; x-forefront-prvs: 0637FCE711 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(39380400002)(346002)(376002)(366004)(39860400002)(396003)(189003)(199004)(5250100002)(2501003)(110136005)(54906003)(6116002)(6436002)(11346002)(1076002)(486006)(25786009)(105586002)(2900100001)(102836004)(86612001)(3846002)(68736007)(107886003)(316002)(10290500003)(5660300001)(86362001)(2616005)(305945005)(4326008)(446003)(6486002)(22452003)(7736002)(575784001)(476003)(8676002)(81156014)(81166006)(8936002)(6512007)(10090500001)(186003)(3280700002)(106356001)(76176011)(2906002)(99286004)(26005)(97736004)(14454004)(6666003)(478600001)(53936002)(6506007)(36756003)(72206003)(66066001)(3660700001)(22906009)(217873001);DIR:OUT;SFP:1102;SCL:1;SRVR:DM5PR2101MB0984;H:DM5PR2101MB1032.namprd21.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: qkTuQnT9oFqMmW8+nwNvMeyUtkmWM8Nwcmw7nVn3N4WMIiaja/XE2gnHCkfisVB2nq8b9XjzsDa18RpH2vqpthZQuRSfakkmGdx7mMuQcQx8icxv6OZmLc8i03NnRfIWRavGUOF/8LoCtXoj9AxMWX9h5xPfAOOUXixzPpsPmYuvTaXhxLf0FHmOsCla9Z+uVtRvc2pivkqFj4u/64Tq9PLvfn7x6OhIbJE8mXc245BdgNti4+Btay4TSGIr3O/9ENPgCOVAaSYov7tWGUKMsIfvjUE9oq/mCnVWHSggC/GYQtUedtvOwtj/Sjx4yen+0cpQhjfS1ePI/QU5g4hrPo0xLFWQ5NNE8KJ7rinFggM277tcSptSJZU0+Okde3dtU8an04nrS0sIHuEGXcvSfAw0iMVUf6835W779yQMhDY= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7da63497-9eee-4b58-208b-08d59db0430d X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Apr 2018 00:20:59.5502 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0984 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Andy Spencer [ Upstream commit 202a0a70e445caee1d0ec7aae814e64b1189fa4d ] When the frame check sequence (FCS) is split across the last two frames of a fragmented packet, part of the FCS gets counted twice, once when subtracting the FCS, and again when subtracting the previously received data. For example, if 1602 bytes are received, and the first fragment contains the first 1600 bytes (including the first two bytes of the FCS), and the second fragment contains the last two bytes of the FCS: 'skb->len =3D=3D 1600' from the first fragment size =3D lstatus & BD_LENGTH_MASK; # 1602 size -=3D ETH_FCS_LEN; # 1598 size -=3D skb->len; # -2 Since the size is unsigned, it wraps around and causes a BUG later in the packet handling, as shown below: kernel BUG at ./include/linux/skbuff.h:2068! Oops: Exception in kernel mode, sig: 5 [#1] ... NIP [c021ec60] skb_pull+0x24/0x44 LR [c01e2fbc] gfar_clean_rx_ring+0x498/0x690 Call Trace: [df7edeb0] [c01e2c1c] gfar_clean_rx_ring+0xf8/0x690 (unreliable) [df7edf20] [c01e33a8] gfar_poll_rx_sq+0x3c/0x9c [df7edf40] [c023352c] net_rx_action+0x21c/0x274 [df7edf90] [c0329000] __do_softirq+0xd8/0x240 [df7edff0] [c000c108] call_do_irq+0x24/0x3c [c0597e90] [c00041dc] do_IRQ+0x64/0xc4 [c0597eb0] [c000d920] ret_from_except+0x0/0x18 --- interrupt: 501 at arch_cpu_idle+0x24/0x5c Change the size to a signed integer and then trim off any part of the FCS that was received prior to the last fragment. Fixes: 6c389fc931bc ("gianfar: fix size of scatter-gathered frames") Signed-off-by: Andy Spencer Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/freescale/gianfar.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/etherne= t/freescale/gianfar.c index 7f837006bb6a..3bdeb295514b 100644 --- a/drivers/net/ethernet/freescale/gianfar.c +++ b/drivers/net/ethernet/freescale/gianfar.c @@ -2932,7 +2932,7 @@ static irqreturn_t gfar_transmit(int irq, void *grp_i= d) static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, struct sk_buff *skb, bool first) { - unsigned int size =3D lstatus & BD_LENGTH_MASK; + int size =3D lstatus & BD_LENGTH_MASK; struct page *page =3D rxb->page; bool last =3D !!(lstatus & BD_LFLAG(RXBD_LAST)); =20 @@ -2947,11 +2947,16 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *r= xb, u32 lstatus, if (last) size -=3D skb->len; =20 - /* in case the last fragment consisted only of the FCS */ + /* Add the last fragment if it contains something other than + * the FCS, otherwise drop it and trim off any part of the FCS + * that was already received. + */ if (size > 0) skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, rxb->page_offset + RXBUF_ALIGNMENT, size, GFAR_RXB_TRUESIZE); + else if (size < 0) + pskb_trim(skb, skb->len + size); } =20 /* try reuse page */ --=20 2.15.1