Received: by 2002:ab2:7041:0:b0:1f4:bcc8:f211 with SMTP id x1csp38148lql; Fri, 12 Apr 2024 03:02:49 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCUfO0qSNUbW99d8MB0v0ZIT5O1kSLfGsAomBoVpkL/Y2yqvwpYN4kNVLGn10Yi1vr6Qe4HsW+Te67opBO4VmUAiRoZ5Mmwc99j9lwQxlQ== X-Google-Smtp-Source: AGHT+IF52Z+fzgU6+ROuIGMvhQsqdSDDVhwvAaPCvt+GL3NHcWtQyB/SNkcXopsg3EW3CDZ58FWX X-Received: by 2002:a05:622a:1495:b0:436:75dc:9aad with SMTP id t21-20020a05622a149500b0043675dc9aadmr2697658qtx.1.1712916169091; Fri, 12 Apr 2024 03:02:49 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1712916169; cv=pass; d=google.com; s=arc-20160816; b=VBgIugOTbCU+Bhx/6Db4EOYJFj4Z52uxUMIO2hnwyplzHvRmZrfuqlVYwdl/T7u5Yh PjJITZGZeytaqP/VLeEV89VLzOsTTcQpdzspx/W+Lpn/pLs1ZUV4VdIzLKHFnsRjAdCn OizGggF21w6fMDAc1LvIKAbvVO4+lPVsF+mG/LIARBrAtOInyJJpEqthEDpL/R9dqgzS Jua5vWjeP15Pcwj9Z42GIZg9tzYNBEIrvV54t1kI9aU6ESUWccwA0LAfrix56YBez9+v A1+ZPfaP9yFj9USi8NGiaFpHIK5sPDLvTztirDuI+nsNi7MDAWmsSLrEwxQCtGQrBYw4 0O/Q== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from; bh=SfhawsPvhEecB5LMuRzJH0PQD60jIC8XguHFCUNAgy8=; fh=DTWwm9RX7fuZ+9MrG0jgaAAB0GzU+sjg57DWXP/tul8=; b=FHEKCZhB2IQVmmVDDuQngd3B6p8WU3MJayp6qGE5fbtSQeLXEgk6Iyh4T7Ct9aBQlN 0uEMnG6tHM6G63xs1mDHVmryZfWqCenkc42m4AEk3dAe3q9F5N9b6fs8UMG63Qfd1Qqm Lf5HvTHqaA6SvRbiSqPgOMVFq3MxEH64Bvzr9ZZLUCrl2eaPJj5VObJviI+uXXyv0qjn zyR9uRNA5QkqTd+x9XLqymNBEfLbgKzHEkn0G0rb+MkGO3GxOd62OLkvEslDxD0Fh7b/ bzg6sUAbOTtpkzSLMqYUj6I4KF6Ddt+jfcTVQ92DeUi6bTchlhZnQH9IgDMsBlRg+2+X /Xog==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=bp.renesas.com dmarc=pass fromdomain=bp.renesas.com); spf=pass (google.com: domain of linux-kernel+bounces-142453-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-142453-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=renesas.com Return-Path: Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [2604:1380:45d1:ec00::1]) by mx.google.com with ESMTPS id q6-20020a05622a04c600b004315aecf91bsi3299318qtx.663.2024.04.12.03.02.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Apr 2024 03:02:49 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel+bounces-142453-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1; Authentication-Results: mx.google.com; arc=pass (i=1 spf=pass spfdomain=bp.renesas.com dmarc=pass fromdomain=bp.renesas.com); spf=pass (google.com: domain of linux-kernel+bounces-142453-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-142453-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=renesas.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id CF2941C213B4 for ; Fri, 12 Apr 2024 10:02:48 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 2E6F956450; Fri, 12 Apr 2024 10:01:26 +0000 (UTC) Received: from relmlie6.idc.renesas.com (relmlor2.renesas.com [210.160.252.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 48A8455774; Fri, 12 Apr 2024 10:01:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=210.160.252.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712916085; cv=none; b=dM07XuYnWfVT4PAd/8XXfNd+S5iLhgUBP5t7QQBxE0oAT7w5nTVAhPsIXvoUhxmYEgrUnyIzT5k+FxEh3m7Slnp1YZdpVOruJqLLTz0ezuw5s/oj7XeHwtos1xnVRi9bl76xVZI6PzBbQVo2NZKD6Npw2badA1cKQBeRIIFMjUs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712916085; c=relaxed/simple; bh=MsTjAOc8LxDsKaFl5Csrf742XdcLyMoxIe5ic/J1zcs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=gs/LpPW9zZXbvpLL0+2lbY4rDt3LHHRN65J6SKe1TQuv1DTyNsdBXW2icGfLvsrUn5od0UCLR/msNiq8jVb5XOggQScMP+J8j87e0aX7s9W1Ln1IejSYc28Kiwd/rzB69gzc5U0sHtIpyBekwjtxcAsw+xT5jG9MBnMSTsZk9fw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=bp.renesas.com; spf=pass smtp.mailfrom=bp.renesas.com; arc=none smtp.client-ip=210.160.252.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=bp.renesas.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bp.renesas.com X-IronPort-AV: E=Sophos;i="6.07,195,1708354800"; d="scan'208";a="205195042" Received: from unknown (HELO relmlir6.idc.renesas.com) ([10.200.68.152]) by relmlie6.idc.renesas.com with ESMTP; 12 Apr 2024 19:01:20 +0900 Received: from renesas-deb12.cephei.uk (unknown [10.226.93.65]) by relmlir6.idc.renesas.com (Postfix) with ESMTP id C03AF41E0D3A; Fri, 12 Apr 2024 19:01:15 +0900 (JST) From: Paul Barker To: Sergey Shtylyov , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , =?UTF-8?q?Niklas=20S=C3=B6derlund?= Cc: Paul Barker , Claudiu Beznea , Biju Das , YueHaibing , netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [net PATCH v2 4/4] net: ravb: Fix RX byte accounting for jumbo packets Date: Fri, 12 Apr 2024 11:00:24 +0100 Message-Id: <20240412100024.2296-5-paul.barker.ct@bp.renesas.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240412100024.2296-1-paul.barker.ct@bp.renesas.com> References: <20240412100024.2296-1-paul.barker.ct@bp.renesas.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The RX byte accounting for jumbo packets was changed to fix a potential use-after-free bug. However, that fix used the wrong variable and so only accounted for the number of bytes in the final descriptor, not the number of bytes in the whole packet. To fix this, we can simply update our stats with the correct number of bytes before calling napi_gro_receive(). Also rename pkt_len to desc_len in ravb_rx_gbeth() to avoid any future confusion. The variable name pkt_len is correct in ravb_rx_rcar() as that function does not handle packets spanning multiple descriptors. Fixes: 5a5a3e564de6 ("ravb: Fix potential use-after-free in ravb_rx_gbeth()") Signed-off-by: Paul Barker Reviewed-by: Sergey Shtylyov --- drivers/net/ethernet/renesas/ravb_main.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c index e1e39f65224c..c4ac9fbe0af4 100644 --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -769,7 +769,7 @@ static bool ravb_rx_gbeth(struct net_device *ndev, int *quota, int q) dma_addr_t dma_addr; int rx_packets = 0; u8 desc_status; - u16 pkt_len; + u16 desc_len; u8 die_dt; int entry; int limit; @@ -787,10 +787,10 @@ static bool ravb_rx_gbeth(struct net_device *ndev, int *quota, int q) /* Descriptor type must be checked before all other reads */ dma_rmb(); desc_status = desc->msc; - pkt_len = le16_to_cpu(desc->ds_cc) & RX_DS; + desc_len = le16_to_cpu(desc->ds_cc) & RX_DS; /* We use 0-byte descriptors to mark the DMA mapping errors */ - if (!pkt_len) + if (!desc_len) continue; if (desc_status & MSC_MC) @@ -811,25 +811,25 @@ static bool ravb_rx_gbeth(struct net_device *ndev, int *quota, int q) switch (die_dt) { case DT_FSINGLE: skb = ravb_get_skb_gbeth(ndev, entry, desc); - skb_put(skb, pkt_len); + skb_put(skb, desc_len); skb->protocol = eth_type_trans(skb, ndev); if (ndev->features & NETIF_F_RXCSUM) ravb_rx_csum_gbeth(skb); napi_gro_receive(&priv->napi[q], skb); rx_packets++; - stats->rx_bytes += pkt_len; + stats->rx_bytes += desc_len; break; case DT_FSTART: priv->rx_1st_skb = ravb_get_skb_gbeth(ndev, entry, desc); - skb_put(priv->rx_1st_skb, pkt_len); + skb_put(priv->rx_1st_skb, desc_len); break; case DT_FMID: skb = ravb_get_skb_gbeth(ndev, entry, desc); skb_copy_to_linear_data_offset(priv->rx_1st_skb, priv->rx_1st_skb->len, skb->data, - pkt_len); - skb_put(priv->rx_1st_skb, pkt_len); + desc_len); + skb_put(priv->rx_1st_skb, desc_len); dev_kfree_skb(skb); break; case DT_FEND: @@ -837,17 +837,17 @@ static bool ravb_rx_gbeth(struct net_device *ndev, int *quota, int q) skb_copy_to_linear_data_offset(priv->rx_1st_skb, priv->rx_1st_skb->len, skb->data, - pkt_len); - skb_put(priv->rx_1st_skb, pkt_len); + desc_len); + skb_put(priv->rx_1st_skb, desc_len); dev_kfree_skb(skb); priv->rx_1st_skb->protocol = eth_type_trans(priv->rx_1st_skb, ndev); if (ndev->features & NETIF_F_RXCSUM) ravb_rx_csum_gbeth(priv->rx_1st_skb); + stats->rx_bytes += priv->rx_1st_skb->len; napi_gro_receive(&priv->napi[q], priv->rx_1st_skb); rx_packets++; - stats->rx_bytes += pkt_len; break; } } -- 2.39.2