Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9892742f authored by Shyam Sundar S K's avatar Shyam Sundar S K Committed by Greg Kroah-Hartman
Browse files

net: amd-xgbe: Fix skb data length underflow 



commit 5aac9108a180fc06e28d4e7fb00247ce603b72ee upstream.

There will be BUG_ON() triggered in include/linux/skbuff.h leading to
intermittent kernel panic, when the skb length underflow is detected.

Fix this by dropping the packet if such length underflows are seen
because of inconsistencies in the hardware descriptors.

Fixes: 622c36f1 ("amd-xgbe: Fix jumbo MTU processing on newer hardware")
Suggested-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarShyam Sundar S K <Shyam-sundar.S-k@amd.com>
Acked-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20220127092003.2812745-1-Shyam-sundar.S-k@amd.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 28bdf65a

drivers/net/ethernet/amd/xgbe/xgbe-drv.c

+11 −1
Original line number Diff line number Diff line
@@ -2767,6 +2767,14 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget) 
			buf2_len = xgbe_rx_buf2_len(rdata, packet, len);

			len += buf2_len;



			if (buf2_len > rdata->rx.buf.dma_len) {

				/* Hardware inconsistency within the descriptors

				 * that has resulted in a length underflow.

				 */

				error = 1;

				goto skip_data;

			}



			if (!skb) {

				skb = xgbe_create_skb(pdata, napi, rdata,

						      buf1_len);
@@ -2796,8 +2804,10 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget) 
		if (!last || context_next)

			goto read_again;



		if (!skb)

		if (!skb || error) {

			dev_kfree_skb(skb);

			goto next_packet;

		}



		/* Be sure we don't exceed the configured MTU */

		max_len = netdev->mtu + ETH_HLEN;