From: Mark Lord <mlord@pobox.com>
To: Francois Romieu <romieu@fr.zoreil.com>,
Hayes Wang <hayeswang@realtek.com>
Cc: netdev@vger.kernel.org, nic_swsd@realtek.com,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org
Subject: Re: [PATCH net 2/2] r8152: rx descriptor check
Date: Sat, 12 Nov 2016 08:21:24 -0500 [thread overview]
Message-ID: <17ddc468-3099-a423-422c-d0ae33489288@pobox.com> (raw)
In-Reply-To: <20161111121311.GA19673@electric-eye.fr.zoreil.com>
On 16-11-11 07:13 AM, Francois Romieu wrote:
> Hayes Wang <hayeswang@realtek.com> :
>> For some platforms, the data in memory is not the same with the one
>> from the device. That is, the data of memory is unbelievable. The
>> check is used to find out this situation.
>
> Invalid packet size corrupted receive descriptors in Realtek's device
> reminds of CVE-2009-4537.
>
> Is the silicium of both devices different enough to prevent the same
> exploit to happen ?
I don't know if the hardware can do it, but the existing Linux device
driver regularly attempts to process huge unreal packet sizes here.
I've had to patch it to reject "packets" larger than the configured MRU.
--
Mark Lord
Real-Time Remedies Inc.
mlord@pobox.com
next prev parent reply other threads:[~2016-11-12 13:21 UTC|newest]
Thread overview: 97+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-11 7:15 [PATCH net 0/2] r8152: rx patches Hayes Wang
2016-11-11 7:15 ` [PATCH net 1/2] r8152: fix the sw rx checksum is unavailable Hayes Wang
2016-11-11 7:15 ` Hayes Wang
2016-11-17 3:36 ` Hayes Wang
2016-11-17 14:14 ` Mark Lord
2016-11-17 14:25 ` Mark Lord
[not found] ` <d683c019-4e0f-6fe6-368c-c4fc86c72fe6@pobox.com>
2016-11-18 7:57 ` Hayes Wang
2016-11-18 7:57 ` Hayes Wang
2016-11-18 12:03 ` Mark Lord
2016-11-22 13:12 ` Mark Lord
2016-11-23 3:52 ` Hayes Wang
2016-11-23 13:41 ` Mark Lord
2016-11-23 15:12 ` Hayes Wang
2016-11-23 19:29 ` Mark Lord
2016-11-23 19:29 ` Mark Lord
2016-11-24 3:24 ` Hayes Wang
2016-11-24 12:31 ` Mark Lord
2016-11-24 12:31 ` Mark Lord
2016-11-24 13:26 ` Hayes Wang
2016-11-24 15:24 ` Mark Lord
2016-11-25 6:11 ` Hayes Wang
2016-11-25 12:36 ` Mark Lord
2016-11-25 12:36 ` Mark Lord
2016-11-24 16:21 ` David Miller
2016-11-24 16:43 ` Mark Lord
2016-11-24 17:00 ` Mark Lord
2016-11-24 17:13 ` David Miller
2016-11-24 17:11 ` David Miller
2016-11-24 18:34 ` Mark Lord
2016-11-24 18:49 ` Mark Lord
2016-11-24 19:00 ` Greg KH
2016-11-24 19:10 ` Mark Lord
2016-11-24 19:17 ` Greg KH
2016-11-25 9:52 ` Hayes Wang
2016-11-25 13:32 ` Mark Lord
2016-11-25 0:27 ` Francois Romieu
2016-11-25 0:27 ` Francois Romieu
2016-11-25 3:49 ` Mark Lord
2016-11-25 9:53 ` Greg KH
2016-11-25 9:53 ` Greg KH
2016-11-25 12:34 ` Mark Lord
2016-11-25 12:34 ` Mark Lord
2016-11-25 12:41 ` Mark Lord
2016-11-25 14:22 ` Greg KH
2016-11-25 14:22 ` Greg KH
2016-11-25 14:35 ` Mark Lord
2016-11-25 12:49 ` Mark Lord
2016-11-25 14:24 ` Greg KH
2016-11-25 16:58 ` David Miller
2016-11-30 11:58 ` Hayes Wang
2016-11-30 11:58 ` Hayes Wang
2016-12-09 3:23 ` Hayes Wang
2016-12-09 13:05 ` Mark Lord
2017-01-01 0:07 ` Ansis Atteka
2017-01-03 0:40 ` Ansis Atteka
2017-01-03 13:19 ` Mark Lord
2017-01-09 7:58 ` Hayes Wang
2019-01-05 14:14 ` r8152: data corruption in various scenarios Mark Lord
2019-01-05 14:14 ` Mark Lord
2019-01-05 14:22 ` Mark Lord
2019-01-06 19:14 ` Kai Heng Feng
2019-01-06 21:13 ` Mark Lord
2019-01-06 21:16 ` Mark Lord
2019-01-07 3:53 ` Hayes Wang
2019-01-07 16:01 ` Mario.Limonciello
2019-01-07 18:06 ` Mark Lord
2019-01-07 18:27 ` Mario.Limonciello
2019-01-07 19:24 ` Mark Lord
2019-01-07 4:09 ` Kai Heng Feng
2019-01-07 4:13 ` Mark Lord
2019-01-07 6:46 ` Kai Heng Feng
2019-01-07 7:01 ` Mark Lord
2016-11-24 18:42 ` [PATCH net 1/2] r8152: fix the sw rx checksum is unavailable Greg KH
2016-11-24 18:58 ` Mark Lord
2016-11-25 6:31 ` Hayes Wang
2016-11-25 6:31 ` Hayes Wang
2016-11-25 6:51 ` Hayes Wang
2016-11-25 6:51 ` Hayes Wang
2016-11-25 12:35 ` Mark Lord
2016-11-24 16:19 ` David Miller
2016-11-24 16:19 ` David Miller
2016-11-24 12:37 ` Hayes Wang
2016-11-11 7:15 ` [PATCH net 2/2] r8152: rx descriptor check Hayes Wang
2016-11-11 12:13 ` Francois Romieu
2016-11-12 13:21 ` Mark Lord [this message]
2016-11-14 6:43 ` Hayes Wang
2016-11-15 1:10 ` Francois Romieu
2016-11-17 3:05 ` Hayes Wang
2016-11-13 17:39 ` David Miller
2016-11-13 17:39 ` David Miller
2016-11-13 20:34 ` Mark Lord
2016-11-13 20:38 ` Mark Lord
2016-11-13 20:38 ` Mark Lord
2016-11-14 7:23 ` Hayes Wang
2016-11-14 17:27 ` David Miller
2016-11-14 7:03 ` Hayes Wang
2016-11-14 7:03 ` Hayes Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=17ddc468-3099-a423-422c-d0ae33489288@pobox.com \
--to=mlord@pobox.com \
--cc=hayeswang@realtek.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nic_swsd@realtek.com \
--cc=romieu@fr.zoreil.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.