From: Jonas Jensen <jonas.jensen@gmail.com>
To: netdev@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, davem@davemloft.net,
f.fainelli@gmail.com, bhutchings@solarflare.com,
Jonas Jensen <jonas.jensen@gmail.com>
Subject: [PATCH v3 2/7] net: moxa: fix build_skb() memory corruption
Date: Mon, 20 Jan 2014 12:13:14 +0100 [thread overview]
Message-ID: <1390216399-27028-2-git-send-email-jonas.jensen@gmail.com> (raw)
In-Reply-To: <1390216399-27028-1-git-send-email-jonas.jensen@gmail.com>
DMA buffer memory must be synchronized and copied before passing skb to
napi_gro_receive(). The use of build_skb() can lead to memory corruption,
replace it with netdev_alloc_skb_ip_align() and memcpy().
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=69041
Signed-off-by: Jonas Jensen <jonas.jensen@gmail.com>
---
Notes:
This fixes the following error on wget download (or ncftp),
usually after only a few seconds:
"read error: Bad address"
On receiving this error, wget exits. The download is not resumed (busybox default).
Applies to next-20140120
drivers/net/ethernet/moxa/moxart_ether.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index aa45607..17c9f0e 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -226,14 +226,21 @@ static int moxart_rx_poll(struct napi_struct *napi, int budget)
if (len > RX_BUF_SIZE)
len = RX_BUF_SIZE;
- skb = build_skb(priv->rx_buf[rx_head], priv->rx_buf_size);
+ dma_sync_single_for_cpu(&ndev->dev,
+ priv->rx_mapping[rx_head],
+ priv->rx_buf_size, DMA_FROM_DEVICE);
+ skb = netdev_alloc_skb_ip_align(ndev, len);
if (unlikely(!skb)) {
- net_dbg_ratelimited("build_skb failed\n");
+ net_dbg_ratelimited("netdev_alloc_skb_ip_align failed\n");
priv->stats.rx_dropped++;
priv->stats.rx_errors++;
}
-
+ memcpy(skb->data, priv->rx_buf[rx_head], len);
skb_put(skb, len);
+ dma_sync_single_for_device(&ndev->dev,
+ priv->rx_mapping[rx_head],
+ priv->rx_buf_size, DMA_FROM_DEVICE);
+
skb->protocol = eth_type_trans(skb, ndev);
napi_gro_receive(&priv->napi, skb);
rx++;
--
1.8.2.1
next prev parent reply other threads:[~2014-01-20 11:13 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-20 11:13 [PATCH v3 1/7] net: moxa: clear TX descriptor length bits between sends Jonas Jensen
2014-01-20 11:13 ` Jonas Jensen [this message]
2014-01-20 11:13 ` [PATCH v3 3/7] net: moxa: connect to PHY Jonas Jensen
[not found] ` <1390216399-27028-3-git-send-email-jonas.jensen-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2014-01-20 14:57 ` Rob Herring
2014-01-21 13:50 ` Jonas Jensen
2014-01-20 11:13 ` [PATCH v3 4/7] net: moxa: add ethtool support Jonas Jensen
2014-01-20 11:13 ` [PATCH v3 5/7] net: moxa: add IFF_LIVE_ADDR_CHANGE flag Jonas Jensen
2014-01-20 11:13 ` [PATCH v3 6/7] net: moxa: generate random address Jonas Jensen
2014-01-20 11:13 ` [PATCH v3 7/7] net: moxa: use eth_mac_addr() Jonas Jensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1390216399-27028-2-git-send-email-jonas.jensen@gmail.com \
--to=jonas.jensen@gmail.com \
--cc=bhutchings@solarflare.com \
--cc=davem@davemloft.net \
--cc=f.fainelli@gmail.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).