[v1] net: ethernet: lantiq_etop: fix memory disclosure

[PATCH net] net: ethernet: lantiq_etop: fix memory disclosure

Posted by Aleksander Jan Bajkowski 1 year, 7 months ago

When applying padding, the buffer is not zeroed, which results in
memory disclosure. This patch uses skb_put_padto() to pad Ethernet
frames properly.

It appears that only the MAC in xrx100 and newer SoCs supports
padding by hardware, so software padding must be applied.

Fixes: 504d4721ee8e ("MIPS: Lantiq: Add ethernet driver")
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
---
 drivers/net/ethernet/lantiq_etop.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 0b9982804370..196715d9ea43 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -478,11 +478,11 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)
 	struct ltq_etop_priv *priv = netdev_priv(dev);
 	struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1];
 	struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc];
-	int len;
 	unsigned long flags;
 	u32 byte_offset;
 
-	len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+	if (skb_put_padto(skb, ETH_ZLEN))
+		return NETDEV_TX_OK;
 
 	if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) {
 		netdev_err(dev, "tx ring full\n");
@@ -497,12 +497,13 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)
 	netif_trans_update(dev);
 
 	spin_lock_irqsave(&priv->lock, flags);
-	desc->addr = ((unsigned int)dma_map_single(&priv->pdev->dev, skb->data, len,
-						DMA_TO_DEVICE)) - byte_offset;
+	desc->addr = ((unsigned int)dma_map_single(&priv->pdev->dev, skb->data,
+						   skb->len, DMA_TO_DEVICE)) -
+						   byte_offset;
 	/* Make sure the address is written before we give it to HW */
 	wmb();
 	desc->ctl = LTQ_DMA_OWN | LTQ_DMA_SOP | LTQ_DMA_EOP |
-		LTQ_DMA_TX_OFFSET(byte_offset) | (len & LTQ_DMA_SIZE_MASK);
+		LTQ_DMA_TX_OFFSET(byte_offset) | (skb->len & LTQ_DMA_SIZE_MASK);
 	ch->dma.desc++;
 	ch->dma.desc %= LTQ_DESC_NUM;
 	spin_unlock_irqrestore(&priv->lock, flags);
-- 
2.39.2

Re: [PATCH net] net: ethernet: lantiq_etop: fix memory disclosure

Posted by Paolo Abeni 1 year, 7 months ago

On 7/14/24 00:33, Aleksander Jan Bajkowski wrote:
> diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
> index 0b9982804370..196715d9ea43 100644
> --- a/drivers/net/ethernet/lantiq_etop.c
> +++ b/drivers/net/ethernet/lantiq_etop.c
> @@ -478,11 +478,11 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)
>   	struct ltq_etop_priv *priv = netdev_priv(dev);
>   	struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1];
>   	struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc];
> -	int len;
>   	unsigned long flags;
>   	u32 byte_offset;
>   
> -	len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
> +	if (skb_put_padto(skb, ETH_ZLEN))

You may want to increment tx drop stats here.

Thanks,

Paolo

Re: [PATCH net] net: ethernet: lantiq_etop: fix memory disclosure

Posted by Aleksander Jan Bajkowski 1 year, 7 months ago

Hi Paolo,

On 16.07.2024 11:46, Paolo Abeni wrote:
> On 7/14/24 00:33, Aleksander Jan Bajkowski wrote:
>> diff --git a/drivers/net/ethernet/lantiq_etop.c 
>> b/drivers/net/ethernet/lantiq_etop.c
>> index 0b9982804370..196715d9ea43 100644
>> --- a/drivers/net/ethernet/lantiq_etop.c
>> +++ b/drivers/net/ethernet/lantiq_etop.c
>> @@ -478,11 +478,11 @@ ltq_etop_tx(struct sk_buff *skb, struct 
>> net_device *dev)
>>       struct ltq_etop_priv *priv = netdev_priv(dev);
>>       struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1];
>>       struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc];
>> -    int len;
>>       unsigned long flags;
>>       u32 byte_offset;
>>   -    len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
>> +    if (skb_put_padto(skb, ETH_ZLEN))
>
> You may want to increment tx drop stats here.

Statistics are on my TODO list. The current version of this driver
does not support statistics, so I will add them then. I would first
prefer to fix all the bugs present in the current version of the driver
and then add new features.


>
> Thanks,
>
> Paolo
>
Best regards,
Aleksander

Re: [PATCH net] net: ethernet: lantiq_etop: fix memory disclosure

Posted by Aleksander Jan Bajkowski 1 year, 6 months ago

On 16.07.2024 21:27, Aleksander Jan Bajkowski wrote:
> Hi Paolo,
>
> On 16.07.2024 11:46, Paolo Abeni wrote:
>> On 7/14/24 00:33, Aleksander Jan Bajkowski wrote:
>>> diff --git a/drivers/net/ethernet/lantiq_etop.c 
>>> b/drivers/net/ethernet/lantiq_etop.c
>>> index 0b9982804370..196715d9ea43 100644
>>> --- a/drivers/net/ethernet/lantiq_etop.c
>>> +++ b/drivers/net/ethernet/lantiq_etop.c
>>> @@ -478,11 +478,11 @@ ltq_etop_tx(struct sk_buff *skb, struct 
>>> net_device *dev)
>>>       struct ltq_etop_priv *priv = netdev_priv(dev);
>>>       struct ltq_etop_chan *ch = &priv->ch[(queue << 1) | 1];
>>>       struct ltq_dma_desc *desc = &ch->dma.desc_base[ch->dma.desc];
>>> -    int len;
>>>       unsigned long flags;
>>>       u32 byte_offset;
>>>   -    len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
>>> +    if (skb_put_padto(skb, ETH_ZLEN))
>>
>> You may want to increment tx drop stats here.
>
> Statistics are on my TODO list. The current version of this driver
> does not support statistics, so I will add them then. I would first
> prefer to fix all the bugs present in the current version of the driver
> and then add new features.


Can this patch be merged? With the current form, it should be easy
to backport. I will add statistics to this driver in the future. I think it
doesn't make sense to increment only one statistic of dropped packets.

>
>
>>
>> Thanks,
>>
>> Paolo
>>
> Best regards,
> Aleksander
>
>