RE: [PATCH net 2/2] r8152: rx descriptor check

From	Hayes Wang <hayeswang@realtek.com>
Newsgroups	linux.kernel
Subject	RE: [PATCH net 2/2] r8152: rx descriptor check
Date	2016-11-14 07:50 +0100
Message-ID	<sDjfz-3nb-5@gated-at.bofh.it> (permalink)
References	<sCehX-1ch-1@gated-at.bofh.it> <sCehX-1ch-13@gated-at.bofh.it> <sCiYi-4ee-13@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Francois Romieu [mailto:romieu@fr.zoreil.com]
> Sent: Friday, November 11, 2016 8:13 PM
[...]
> Invalid packet size corrupted receive descriptors in Realtek's device
> reminds of CVE-2009-4537.

Do you mean that the driver would get a packet exceed the size
which is set to RxMaxSize? I check it with our hw engineers.
They don't get any issue about RxMaxSize. And their test for
RxMaxSize register is fine.

> Is the silicium of both devices different enough to prevent the same
> exploit to happen ?

For this case, I don't think the device provide a invalid value
for the receive descriptors. However, the driver sees a different
value. That is why I say the memory is unbelievable.

Best Regards,
Hayes

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

RE: [PATCH net 2/2] r8152: rx descriptor check Hayes Wang <hayeswang@realtek.com> - 2016-11-14 07:50 +0100
  Re: [PATCH net 2/2] r8152: rx descriptor check Francois Romieu <romieu@fr.zoreil.com> - 2016-11-15 02:20 +0100
    RE: [PATCH net 2/2] r8152: rx descriptor check Hayes Wang <hayeswang@realtek.com> - 2016-11-17 04:10 +0100

csiph-web