mirror of
https://github.com/openwrt/openwrt.git
synced 2025-01-14 08:50:14 +00:00
43 lines
1.7 KiB
Diff
43 lines
1.7 KiB
Diff
|
From 45c0de18ff2dc9af01236380404bbd6a46502c69 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Aleksander Jan Bajkowski <olek2@wp.pl>
|
||
|
|
Date: Mon, 23 Sep 2024 23:49:49 +0200
|
||
|
|
Subject: net: ethernet: lantiq_etop: fix memory disclosure
|
||
|
|
|
||
|
|
When applying padding, the buffer is not zeroed, which results in memory
|
||
|
|
disclosure. The mentioned data is observed on the wire. This patch uses
|
||
|
|
skb_put_padto() to pad Ethernet frames properly. The mentioned function
|
||
|
|
zeroes the expanded buffer.
|
||
|
|
|
||
|
|
In case the packet cannot be padded it is silently dropped. Statistics
|
||
|
|
are also not incremented. This driver does not support statistics in the
|
||
|
|
old 32-bit format or the new 64-bit format. These will be added in the
|
||
|
|
future. In its current form, the patch should be easily backported to
|
||
|
|
stable versions.
|
||
|
|
|
||
|
|
Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets
|
||
|
|
in hardware, so software padding must be applied.
|
||
|
|
|
||
|
|
Fixes: 504d4721ee8e ("MIPS: Lantiq: Add ethernet driver")
|
||
|
|
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
|
||
|
|
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
|
||
|
|
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
|
||
|
|
Link: https://patch.msgid.link/20240923214949.231511-2-olek2@wp.pl
|
||
|
|
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
||
|
|
---
|
||
|
|
drivers/net/ethernet/lantiq_etop.c | 4 +++-
|
||
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
--- a/drivers/net/ethernet/lantiq_etop.c
|
||
|
|
+++ b/drivers/net/ethernet/lantiq_etop.c
|
||
|
|
@@ -482,7 +482,9 @@ ltq_etop_tx(struct sk_buff *skb, struct
|
||
|
|
unsigned long flags;
|
||
|
|
u32 byte_offset;
|
||
|
|
|
||
|
|
- len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
|
||
|
|
+ if (skb_put_padto(skb, ETH_ZLEN))
|
||
|
|
+ return NETDEV_TX_OK;
|
||
|
|
+ len = skb->len;
|
||
|
|
|
||
|
|
if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) {
|
||
|
|
netdev_err(dev, "tx ring full\n");
|