MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 15:03:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
9d9b1219d0
linux-yocto/net
History
Jakob Unterwurzacher 48f5e27c6d net: dsa: microchip: linearize skb for tail-tagging switches 
[ Upstream commit ba54bce747 ]

The pointer arithmentic for accessing the tail tag only works
for linear skbs.

For nonlinear skbs, it reads uninitialized memory inside the
skb headroom, essentially randomizing the tag. I have observed
it gets set to 6 most of the time.

Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6
(which does not exist for the ksz9896 that's in use), dropping the packet.
Debug prints added by me (not included in this patch):

	[  256.645337] ksz9477_rcv:323 tag0=6
	[  256.645349] skb len=47 headroom=78 headlen=0 tailroom=0
	               mac=(64,14) mac_len=14 net=(78,0) trans=78
	               shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))
	               csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0)
	               hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3
	               priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0
	               encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
	[  256.645377] dev name=end1 feat=0x0002e10200114bb3
	[  256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06
	[  256.645428] skb frag:     00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02
	[  256.645436] skb frag:     00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00
	[  256.645444] skb frag:     00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
	[  256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL

Call skb_linearize before trying to access the tag.

This patch fixes ksz9477_rcv which is used by the ksz9896 I have at
hand, and also applies the same fix to ksz8795_rcv which seems to have
the same problem.

Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
CC: stable@vger.kernel.org
Fixes: 016e43a26b ("net: dsa: ksz: Add KSZ8795 tag code")
Fixes: 8b8010fb78 ("dsa: add support for Microchip KSZ tail tagging")
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://patch.msgid.link/20250515072920.2313014-1-jakob.unterwurzacher@cherry.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-09 18:45:23 +02:00
..
6lowpan
9p 9p/xen: fix release of IRQ 2024-12-14 19:48:15 +01:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-02-01 18:22:18 +01:00
8021q net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime 2025-08-28 16:22:29 +02:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:22:30 +02:00
atm net: atm: fix memory leak in atm_register_sysfs when device_register fail 2025-09-09 18:45:20 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:45:20 +02:00
batman-adv batman-adv: fix OOB read/write in network-coding decode 2025-09-09 18:45:21 +02:00
bluetooth Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() 2025-09-09 18:45:19 +02:00
bpf
bpfilter
bridge netfilter: nft_reject: unify reject init and dump into nft_reject 2025-08-28 16:22:59 +02:00
caif caif: reduce stack size, again 2025-08-28 16:22:32 +02:00
can can: bcm: add missing rcu read protection for procfs content 2025-06-04 14:37:07 +02:00
ceph
core netpoll: prevent hanging NAPI when netcons gets enabled 2025-08-28 16:22:37 +02:00
dcb
dccp net: fix data-races around sk->sk_forward_alloc 2025-02-01 18:22:31 +01:00
decnet
dns_resolver
dsa net: dsa: microchip: linearize skb for tail-tagging switches 2025-09-09 18:45:23 +02:00
ethernet
ethtool ethtool: Fix wrong mod state in case of verbose and no_mask bitset 2024-12-14 19:48:20 +01:00
hsr net, hsr: reject HSR frame if skb can't hold tag 2025-08-28 16:22:51 +02:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:48:27 +01:00
ife
ipv4 ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() 2025-09-09 18:45:20 +02:00
ipv6 icmp: fix icmp_ndo_send address translation for reply direction 2025-09-09 18:45:19 +02:00
iucv
kcm
key
l2tp genetlink: hold RCU in genlmsg_mcast() 2024-11-08 16:21:57 +01:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:08:35 +02:00
lapb
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:37:07 +02:00
mac80211 Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" 2025-08-28 16:22:33 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-02-01 18:22:28 +01:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:04:22 +01:00
mptcp mptcp: sockopt: fix getting IPV6_V6ONLY 2025-05-02 07:41:04 +02:00
ncsi net: ncsi: Fix buffer overflow in fetching version id 2025-08-28 16:22:44 +02:00
netfilter netfilter: conntrack: helper: Replace -EEXIST by -EBUSY 2025-09-09 18:45:18 +02:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:04:11 +01:00
netlink netlink: avoid infinite retry looping in netlink_unicast() 2025-08-28 16:22:38 +02:00
netrom netrom: check buffer length before accessing it 2025-01-09 13:25:02 +01:00
nfc NFC: nci: uart: Set tty->disc_data only in success path 2025-06-27 11:04:13 +01:00
nsh
openvswitch net: openvswitch: Fix the dead loop of MPLS parse 2025-06-27 11:04:04 +01:00
packet net/packet: fix a race in packet_set_ring() and packet_notifier() 2025-08-28 16:22:38 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:22:27 +02:00
psample
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:07:58 +02:00
rds
rfkill net: rfkill: gpio: Add check for clk_enable() 2024-12-14 19:47:55 +01:00
rose rose: fix dangling neighbour pointers in rose_rt_device_down() 2025-07-17 18:27:47 +02:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:27:54 +02:00
sched net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate 2025-08-28 16:22:59 +02:00
sctp sctp: initialize more fields in sctp_v6_from_sk() 2025-09-04 14:41:43 +02:00
smc net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-03-13 12:46:48 +01:00
strparser
sunrpc sunrpc: fix race in cache cleanup causing stale nextcheck time 2025-06-27 11:04:16 +01:00
switchdev
tipc tipc: Fix use-after-free in tipc_conn_close(). 2025-07-17 18:27:52 +02:00
tls bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls 2025-08-28 16:22:32 +02:00
unix
vmw_vsock vsock: Do not allow binding to VMADDR_PORT_ANY 2025-08-28 16:22:38 +02:00
wimax
wireless wifi: cfg80211: fix use-after-free in cmp_bss() 2025-09-09 18:45:18 +02:00
x25
xdp
xfrm xfrm: Sanitize marks before insert 2025-06-04 14:37:07 +02:00
compat.c
devres.c
Kconfig bpf: Clean up sockmap related Kconfigs 2025-06-27 11:04:09 +01:00
Makefile
socket.c
sysctl_net.c