mirror of
git://git.yoctoproject.org/linux-yocto.git
synced 2025-07-05 05:15:23 +02:00
ba689e0893
commit ba54bce747fa9e07896c1abd9b48545f7b4b31d2 upstream. The pointer arithmentic for accessing the tail tag only works for linear skbs. For nonlinear skbs, it reads uninitialized memory inside the skb headroom, essentially randomizing the tag. I have observed it gets set to 6 most of the time. Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6 (which does not exist for the ksz9896 that's in use), dropping the packet. Debug prints added by me (not included in this patch): [ 256.645337] ksz9477_rcv:323 tag0=6 [ 256.645349] skb len=47 headroom=78 headlen=0 tailroom=0 mac=(64,14) mac_len=14 net=(78,0) trans=78 shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0)) csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0) hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3 priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0 encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0) [ 256.645377] dev name=end1 feat=0x0002e10200114bb3 [ 256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06 [ 256.645428] skb frag: 00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02 [ 256.645436] skb frag: 00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00 [ 256.645444] skb frag: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 [ 256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL Call skb_linearize before trying to access the tag. This patch fixes ksz9477_rcv which is used by the ksz9896 I have at hand, and also applies the same fix to ksz8795_rcv which seems to have the same problem. Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de> CC: stable@vger.kernel.org Fixes: |
||
|---|---|---|
| .. | ||
| conduit.c | ||
| conduit.h | ||
| devlink.c | ||
| devlink.h | ||
| dsa.c | ||
| dsa.h | ||
| Kconfig | ||
| Makefile | ||
| netlink.c | ||
| netlink.h | ||
| port.c | ||
| port.h | ||
| stubs.c | ||
| switch.c | ||
| switch.h | ||
| tag_8021q.c | ||
| tag_8021q.h | ||
| tag_ar9331.c | ||
| tag_brcm.c | ||
| tag_dsa.c | ||
| tag_gswip.c | ||
| tag_hellcreek.c | ||
| tag_ksz.c | ||
| tag_lan9303.c | ||
| tag_mtk.c | ||
| tag_none.c | ||
| tag_ocelot_8021q.c | ||
| tag_ocelot.c | ||
| tag_qca.c | ||
| tag_rtl4_a.c | ||
| tag_rtl8_4.c | ||
| tag_rzn1_a5psw.c | ||
| tag_sja1105.c | ||
| tag_trailer.c | ||
| tag_vsc73xx_8021q.c | ||
| tag_xrs700x.c | ||
| tag.c | ||
| tag.h | ||
| trace.c | ||
| trace.h | ||
| user.c | ||
| user.h | ||