Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Tue, 19 Mar 2019 13:33:44 -0700 (PDT)
Message-Id: <20190319.133344.1485034729701481720.davem@davemloft.net>
To:     aaro.koskinen@iki.fi
Cc:     peppe.cavallaro@st.com, alexandre.torgue@st.com,
        joabreu@synopsys.com, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, aaro.koskinen@nokia.com
Subject: Re: [PATCH] net: stmmac: fix memory corruption with large MTUs
From:   David Miller <davem@davemloft.net>
In-Reply-To: <20190318213608.612-1-aaro.koskinen@iki.fi>
References: <20190318213608.612-1-aaro.koskinen@iki.fi>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

From: Aaro Koskinen <aaro.koskinen@iki.fi>
Date: Mon, 18 Mar 2019 23:36:08 +0200

> From: Aaro Koskinen <aaro.koskinen@nokia.com>
> 
> When using 16K DMA buffers and ring mode, the DES3 refill is not working
> correctly as the function is using a bogus pointer for checking the
> private data. As a result stale pointers will remain in the RX descriptor
> ring, so DMA will now likely overwrite/corrupt some already freed memory.
> 
> As simple reproducer, just receive some UDP traffic:
 ...
> Fixes: 54139cf3bb33 ("net: stmmac: adding multiple buffers for rx")
> Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>

Applied and queued up for -stable, thank you.