Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1667105

[PATCH 4.4 07/46] net: xilinx_emaclite: fix receive buffer overflow

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anssi Hannula <anssi.hannula@bitwise.fi>


[ Upstream commit cd224553641848dd17800fe559e4ff5d208553e8 ]

xilinx_emaclite looks at the received data to try to determine the
Ethernet packet length but does not properly clamp it if
proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer
overflow and a panic via skb_panic() as the length exceeds the allocated
skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/xilinx/xilinx_emaclite.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -379,7 +379,7 @@ static int xemaclite_send_data(struct ne
  *
  * Return:	Total number of bytes received
  */
-static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data)
+static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
 {
 	void __iomem *addr;
 	u16 length, proto_type;
@@ -419,7 +419,7 @@ static u16 xemaclite_recv_data(struct ne
 
 	/* Check if received ethernet frame is a raw ethernet frame
 	 * or an IP packet or an ARP packet */
-	if (proto_type > (ETH_FRAME_LEN + ETH_FCS_LEN)) {
+	if (proto_type > ETH_DATA_LEN) {
 
 		if (proto_type == ETH_P_IP) {
 			length = ((ntohl(xemaclite_readl(addr +
@@ -427,6 +427,7 @@ static u16 xemaclite_recv_data(struct ne
 					XEL_RXBUFF_OFFSET)) >>
 					XEL_HEADER_SHIFT) &
 					XEL_RPLR_LENGTH_MASK);
+			length = min_t(u16, length, ETH_DATA_LEN);
 			length += ETH_HLEN + ETH_FCS_LEN;
 
 		} else if (proto_type == ETH_P_ARP)
@@ -439,6 +440,9 @@ static u16 xemaclite_recv_data(struct ne
 		/* Use the length in the frame, plus the header and trailer */
 		length = proto_type + ETH_HLEN + ETH_FCS_LEN;
 
+	if (WARN_ON(length > maxlen))
+		length = maxlen;
+
 	/* Read from the EmacLite device */
 	xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET),
 				data, length);
@@ -613,7 +617,7 @@ static void xemaclite_rx_handler(struct
 
 	skb_reserve(skb, 2);
 
-	len = xemaclite_recv_data(lp, (u8 *) skb->data);
+	len = xemaclite_recv_data(lp, (u8 *) skb->data, len);
 
 	if (!len) {
 		dev->stats.rx_errors++;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/46] 4.4.73-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 21/46] ethtool: do not vzalloc(0) on registers dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 27/46] drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 33/46] drm/nouveau: Dont enabling polling twice on runtime resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 09/46] ipv6: Inhibit IPv4-mapped src address on the wire. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 32/46] parisc, parport_gsc: Fixes for printk continuation lines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 45/46] s390/kvm: do not rely on the ILC on kvm host protection fauls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 17/46] PM / runtime: Avoid false-positive warnings from might_sleep_if() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 37/46] r8152: re-schedule napi for tx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 22/46] fscache: Fix dead object requeue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 28/46] net/mlx4_core: Avoid command timeouts during VF driver device shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:00 +0200
  [PATCH 4.4 44/46] xtensa: dont use linux IRQ #0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 41/46] romfs: use different way to generate fsid for BLOCK or MTD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 46/46] sparc64: make string buffers large enough Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 38/46] r8152: fix rtl8152_post_reset function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 42/46] proc: add a schedule point in proc_pid_readdir() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 39/46] r8152: avoid start_xmit to schedule napi when napi is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:30 +0200
  [PATCH 4.4 31/46] net: adaptec: starfire: add checks for dma mapping errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 24/46] FS-Cache: Initialise stores_lock in netfs cookie Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 30/46] pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 11/46] NET: mkiss: Fix panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 04/46] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 07/46] net: xilinx_emaclite: fix receive buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 08/46] ipv6: Handle IPv4-mapped src to in6addr_any dst. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 18/46] jump label: pass kbuild_cflags when checking for asm goto support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 29/46] gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 12/46] net: hns: Fix the device being used for dma mapping during TX Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 35/46] ravb: unmap descriptors when freeing rings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 03/46] ARM: dts: imx6dl: Fix the VDD_ARM_CAP voltage for 396MHz operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 23/46] fscache: Clear outstanding writes when disabling a cookie Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 15/46] i2c: piix4: Fix request_region size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 10/46] NET: Fix /proc/net/arp for AX.25 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 25/46] ipv6: fix flow labels when the traffic class is non-0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 36/46] nfs: Fix "Dont increment lock sequence ID after NFS4ERR_MOVED" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 34/46] drm/ast: Fixed system hanged if disable P2A Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 26/46] drm/nouveau: prevent userspace from deleting client object Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 05/46] Call echo service immediately after socket reconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 40/46] sctp: sctp_addr_id2transport should verify the addr before looking up assoc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  [PATCH 4.4 20/46] log2: make order_base_2() behave correctly on const input value zero Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-15 20:40 +0200
  Re: [PATCH 4.4 00/46] 4.4.73-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-16 00:30 +0200
  Re: [PATCH 4.4 00/46] 4.4.73-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-16 02:40 +0200

csiph-web