[PATCH net] net: amd-xgbe: Fix skb data length underflow

[PATCH net] net: amd-xgbe: Fix skb data length underflow

[Shyam Sundar S K]

There will be BUG_ON() triggered in include/linux/skbuff.h leading to
intermittent kernel panic, when the skb length underflow is detected.

Fix this by dropping the packet if such length underflows are seen
because of inconsistencies in the hardware descriptors.

Fixes: 622c36f143fc ("amd-xgbe: Fix jumbo MTU processing on newer hardware")
Suggested-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
---
 drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 492ac383f16d..ec3b287e3a71 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -2550,6 +2550,14 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
 			buf2_len = xgbe_rx_buf2_len(rdata, packet, len);
 			len += buf2_len;
 
+			if (buf2_len > rdata->rx.buf.dma_len) {
+				/* Hardware inconsistency within the descriptors
+				 * that has resulted in a length underflow.
+				 */
+				error = 1;
+				goto skip_data;
+			}
+
 			if (!skb) {
 				skb = xgbe_create_skb(pdata, napi, rdata,
 						      buf1_len);
@@ -2579,8 +2587,10 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
 		if (!last || context_next)
 			goto read_again;
 
-		if (!skb)
+		if (!skb || error) {
+			dev_kfree_skb(skb);
 			goto next_packet;
+		}
 
 		/* Be sure we don't exceed the configured MTU */
 		max_len = netdev->mtu + ETH_HLEN;
-- 
2.25.1

Re: [PATCH net] net: amd-xgbe: Fix skb data length underflow

[Tom Lendacky]

On 1/27/22 03:20, Shyam Sundar S K wrote:
> There will be BUG_ON() triggered in include/linux/skbuff.h leading to
> intermittent kernel panic, when the skb length underflow is detected.
> 
> Fix this by dropping the packet if such length underflows are seen
> because of inconsistencies in the hardware descriptors.
> 
> Fixes: 622c36f143fc ("amd-xgbe: Fix jumbo MTU processing on newer hardware")
> Suggested-by: Tom Lendacky <thomas.lendacky@amd.com>
> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>

Acked-by: Tom Lendacky <thomas.lendacky@amd.com>

> ---
>   drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 12 +++++++++++-
>   1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
> index 492ac383f16d..ec3b287e3a71 100644
> --- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
> +++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
> @@ -2550,6 +2550,14 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
>   			buf2_len = xgbe_rx_buf2_len(rdata, packet, len);
>   			len += buf2_len;
>   
> +			if (buf2_len > rdata->rx.buf.dma_len) {
> +				/* Hardware inconsistency within the descriptors
> +				 * that has resulted in a length underflow.
> +				 */
> +				error = 1;
> +				goto skip_data;
> +			}
> +
>   			if (!skb) {
>   				skb = xgbe_create_skb(pdata, napi, rdata,
>   						      buf1_len);
> @@ -2579,8 +2587,10 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
>   		if (!last || context_next)
>   			goto read_again;
>   
> -		if (!skb)
> +		if (!skb || error) {
> +			dev_kfree_skb(skb);
>   			goto next_packet;
> +		}
>   
>   		/* Be sure we don't exceed the configured MTU */
>   		max_len = netdev->mtu + ETH_HLEN;

Re: [PATCH net] net: amd-xgbe: Fix skb data length underflow

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 27 Jan 2022 14:50:03 +0530 you wrote:
> There will be BUG_ON() triggered in include/linux/skbuff.h leading to
> intermittent kernel panic, when the skb length underflow is detected.
> 
> Fix this by dropping the packet if such length underflows are seen
> because of inconsistencies in the hardware descriptors.
> 
> Fixes: 622c36f143fc ("amd-xgbe: Fix jumbo MTU processing on newer hardware")
> Suggested-by: Tom Lendacky <thomas.lendacky@amd.com>
> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
> 
> [...]

Here is the summary with links:
  - [net] net: amd-xgbe: Fix skb data length underflow
    https://git.kernel.org/netdev/net/c/5aac9108a180

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html