mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-05-24 10:39:52 +00:00
ba54bce747
The pointer arithmentic for accessing the tail tag only works for linear skbs. For nonlinear skbs, it reads uninitialized memory inside the skb headroom, essentially randomizing the tag. I have observed it gets set to 6 most of the time. Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6 (which does not exist for the ksz9896 that's in use), dropping the packet. Debug prints added by me (not included in this patch): [ 256.645337] ksz9477_rcv:323 tag0=6 [ 256.645349] skb len=47 headroom=78 headlen=0 tailroom=0 mac=(64,14) mac_len=14 net=(78,0) trans=78 shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0)) csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0) hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3 priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0 encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0) [ 256.645377] dev name=end1 feat=0x0002e10200114bb3 [ 256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06 [ 256.645428] skb frag: 00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02 [ 256.645436] skb frag: 00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00 [ 256.645444] skb frag: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 [ 256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL Call skb_linearize before trying to access the tag. This patch fixes ksz9477_rcv which is used by the ksz9896 I have at hand, and also applies the same fix to ksz8795_rcv which seems to have the same problem. Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de> CC: stable@vger.kernel.org Fixes: |
||
|---|---|---|
| .. | ||
| conduit.c | ||
| conduit.h | ||
| devlink.c | ||
| devlink.h | ||
| dsa.c | ||
| dsa.h | ||
| Kconfig | ||
| Makefile | ||
| netlink.c | ||
| netlink.h | ||
| port.c | ||
| port.h | ||
| stubs.c | ||
| switch.c | ||
| switch.h | ||
| tag.c | ||
| tag.h | ||
| tag_8021q.c | ||
| tag_8021q.h | ||
| tag_ar9331.c | ||
| tag_brcm.c | ||
| tag_dsa.c | ||
| tag_gswip.c | ||
| tag_hellcreek.c | ||
| tag_ksz.c | ||
| tag_lan9303.c | ||
| tag_mtk.c | ||
| tag_none.c | ||
| tag_ocelot.c | ||
| tag_ocelot_8021q.c | ||
| tag_qca.c | ||
| tag_rtl4_a.c | ||
| tag_rtl8_4.c | ||
| tag_rzn1_a5psw.c | ||
| tag_sja1105.c | ||
| tag_trailer.c | ||
| tag_vsc73xx_8021q.c | ||
| tag_xrs700x.c | ||
| trace.c | ||
| trace.h | ||
| user.c | ||
| user.h | ||