redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/drivers
History
Friedemann Gerold d26ed6b0e5 net: aquantia: memory corruption on jumbo frames 
This patch fixes skb_shared area, which will be corrupted
upon reception of 4K jumbo packets.

Originally build_skb usage purpose was to reuse page for skb to eliminate
needs of extra fragments. But that logic does not take into account that
skb_shared_info should be reserved at the end of skb data area.

In case packet data consumes all the page (4K), skb_shinfo location
overflows the page. As a consequence, __build_skb zeroed shinfo data above
the allocated page, corrupting next page.

The issue is rarely seen in real life because jumbo are normally larger
than 4K and that causes another code path to trigger.
But it 100% reproducible with simple scapy packet, like:

    sendp(IP(dst="192.168.100.3") / TCP(dport=443) \
          / Raw(RandString(size=(4096-40))), iface="enp1s0")

Fixes: 018423e90b ("net: ethernet: aquantia: Add ring support code")

Reported-by: Friedemann Gerold <f.gerold@b-c-s.de>
Reported-by: Michael Rauch <michael@rauch.be>
Signed-off-by: Friedemann Gerold <f.gerold@b-c-s.de>
Tested-by: Nikita Danilov <nikita.danilov@aquantia.com>
Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2018-09-23 22:25:25 -07:00
..
accessibility
…
acpi Merge branch 'acpi-bus' 2018-09-07 10:05:20 +02:00
amba
…
android android: binder: fix the race mmap and alloc_new_buf_locked 2018-09-12 09:18:29 +02:00
ata SCSI fixes on 20180905 2018-09-05 09:17:20 -07:00
atm
…
auxdisplay Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00
base firmware: Fix security issue with request_firmware_into_buf() 2018-09-12 09:31:00 +02:00
bcma
…
block for-linus-20180913 2018-09-13 19:16:11 -10:00
bluetooth Bluetooth: hci_ldisc: Free rw_semaphore on close 2018-09-11 13:33:57 +02:00
bus Merge branch 'perm-fix' into omap-for-v4.19/fixes-v2 2018-08-28 09:58:03 -07:00
cdrom cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status 2018-08-29 08:09:20 -06:00
char A few fixes that came around or after the merge window, except 2018-09-12 19:33:56 -10:00
clk clk: x86: Stop marking clocks as CLK_IS_CRITICAL 2018-09-17 18:47:58 -07:00
clocksource RISC-V Updates for the 4.19 Merge Window 2018-08-19 09:56:38 -07:00
connector
…
cpufreq ARM: SoC driver updates 2018-08-23 13:52:46 -07:00
cpuidle cpuidle: menu: Retain tick when shallow state is selected 2018-08-25 13:16:08 +02:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2018-08-29 13:38:39 -07:00
dax drivers/dax/device.c: convert variable to vm_fault_t type 2018-09-04 16:45:02 -07:00
dca
…
devfreq Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00
dio
…
dma dmaengine: mic_x100_dma: use devm_kzalloc to fix an issue 2018-08-27 11:16:04 +05:30
dma-buf
…
edac EDAC: Add missing MEM_LRDDR4 entry in edac_mem_types[] 2018-08-17 15:13:34 +02:00
eisa
…
extcon
…
firewire firewire: use 64-bit time_t based interfaces 2018-08-17 16:20:27 -07:00
firmware firmware: arm_scmi: fix divide by zero when sustained_perf_level is zero 2018-09-06 09:59:40 -07:00
fmc
…
fpga fpga: dfl: fme: fix return value check in in pr_mgmt_init() 2018-09-12 09:31:00 +02:00
fsi fsi: sbefifo: Bump max command length 2018-08-08 15:44:47 +10:00
gnss
…
gpio gpio: Fix crash due to registration race 2018-08-31 11:30:45 +02:00
gpu Merge branch 'linux-4.19' of git://github.com/skeggsb/linux into drm-fixes 2018-09-14 09:38:42 +10:00
hid HID: i2c-hid: Don't reset device upon system resume 2018-09-06 16:30:53 +02:00
hsi
…
hv vmbus: don't return values for uninitalized channels 2018-09-12 09:31:00 +02:00
hwmon ARM: SoC fixes 2018-09-08 15:38:57 -07:00
hwspinlock hwspinlock: Fix incorrect return pointers 2018-07-30 20:54:51 -07:00
hwtracing drivers/hwtracing/intel_th/msu.c: change return type to vm_fault_t 2018-08-23 18:48:43 -07:00
i2c i2c: xiic: Make the start and the byte count write atomic 2018-09-06 20:49:09 +02:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide 2018-08-22 07:40:33 -07:00
idle
…
iio First set of IIO fixes for the 4.19 cycle. 2018-09-09 09:33:29 +02:00
infiniband pci-v4.19-fixes-1 2018-09-12 19:39:56 -10:00
input ARM: 32-bit SoC platform updates 2018-08-23 13:44:43 -07:00
iommu ARM: SoC: late updates 2018-08-25 14:12:36 -07:00
ipack
…
irqchip irqchip/gic-v3-its: Cap lpi_id_bits to reduce memory footprint 2018-09-06 20:31:59 +02:00
isdn isdn: Disable IIOCDBGVAR 2018-08-16 12:26:24 -07:00
leds leds: ns2: Change unsigned to unsigned int 2018-08-06 23:03:12 +02:00
lightnvm
…
macintosh macintosh: therm_windtunnel: drop using attach_adapter 2018-08-24 14:42:42 +02:00
mailbox mailbox: Add support for i.MX messaging unit 2018-08-15 09:53:07 +05:30
mcb
…
md - DM verity fix for crash due to using vmalloc'd buffers with the 2018-09-13 19:12:55 -10:00
media Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax 2018-08-26 11:48:42 -07:00
memory memory: ti-aemif: fix a potential NULL-pointer dereference 2018-09-06 10:04:07 -07:00
memstick
…
message scsi: message: fusion: Replace GFP_ATOMIC with GFP_KERNEL 2018-07-30 23:17:53 -04:00
mfd Merge branch 'i2c/for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-08-21 17:40:46 -07:00
misc misc: hmc6352: fix potential Spectre v1 2018-09-12 09:31:00 +02:00
mmc mmc: meson-mx-sdio: fix OF child-node lookup 2018-09-05 08:28:45 +02:00
mtd mtd: rawnand: denali: do not pass zero maxchips to nand_scan() 2018-08-27 20:41:46 +02:00
mux mux: adgs1408: new driver for Analog Devices ADGS1408/1409 mux 2018-08-02 10:23:02 +02:00
net net: aquantia: memory corruption on jumbo frames 2018-09-23 22:25:25 -07:00
nfc
…
ntb
…
nubus
…
nvdimm libnvdimm-for-4.19_dax-memory-failure 2018-08-25 18:43:59 -07:00
nvme nvmet-rdma: fix possible bogus dereference under heavy load 2018-09-05 12:18:01 -07:00
nvmem
…
of Devicetree fixes for 4.19, part 2: 2018-09-14 13:03:17 -10:00
opp
…
oprofile
…
parisc
…
parport Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00
pci PCI: hv: Fix return value check in hv_pci_assign_slots() 2018-09-21 19:13:22 -07:00
pcmcia pcmcia: remove long deprecated pcmcia_request_exclusive_irq() function 2018-08-18 12:30:42 -07:00
perf Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00
phy
…
pinctrl pinctrl: madera: Fix possible NULL pointer with pdata config 2018-08-29 14:02:47 +02:00
platform platform-drivers-x86 for v4.19-1 2018-08-22 14:14:15 -07:00
pnp
…
power treewide: convert ISO_8859-1 text comments to utf-8 2018-08-23 18:48:43 -07:00
powercap
…
pps
…
ps3
…
ptp Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00
pwm pwm: mediatek: Add MT7628 support 2018-08-20 11:36:07 +02:00
rapidio drivers/rapidio/devices/rio_mport_cdev.c: remove redundant pointer md 2018-08-22 10:52:51 -07:00
ras
…
regulator - New Drivers 2018-08-20 15:38:44 -07:00
remoteproc remoteproc/davinci: use the reset framework 2018-08-16 17:39:55 -07:00
reset ARM: SoC: late updates 2018-08-25 14:12:36 -07:00
rpmsg rpmsg: Add compat ioctl for rpmsg char driver 2018-07-30 23:40:23 -07:00
rtc RTC for 4.19 2018-08-20 16:30:27 -07:00
s390 s390 fixes for 4.19-rc4 2018-09-13 16:22:24 -10:00
sbus
…
scsi scsi: qedi: Add the CRC size within iSCSI NVM image 2018-08-30 07:15:22 -04:00
sfi
…
sh sh: introduce a sh_cacheop_vaddr helper 2018-08-02 13:54:06 +02:00
siox
…
slimbus
…
sn
…
soc ARM: Device-tree updates 2018-08-23 14:02:22 -07:00
soundwire
…
spi spi: Fixes for v4.19 2018-09-17 22:34:25 +02:00
spmi
…
ssb ssb: Remove SSB_WARN_ON, SSB_BUG_ON and SSB_DEBUG 2018-08-09 18:47:47 +03:00
staging staging: vboxvideo: Change address of scanout buffer on page-flip 2018-09-11 18:39:54 +02:00
target scsi: iscsi: target: Fix conn_ops double free 2018-08-30 07:07:12 -04:00
tc
…
tee ARM: SoC driver updates 2018-08-23 13:52:46 -07:00
thermal Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal 2018-08-28 16:11:34 -07:00
thunderbolt
…
tty tty: hvc: hvc_write() fix break condition 2018-09-10 18:04:31 +02:00
uio Char/Misc fix for 4.19-rc1 2018-08-19 09:30:44 -07:00
usb Revert "cdc-acm: implement put_char() and flush_chars()" 2018-09-10 20:40:29 +02:00
uwb
…
vfio powerpc updates for 4.19 2018-08-17 11:32:50 -07:00
vhost Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-08-27 11:59:39 -07:00
video fbdev changes for v4.19: 2018-08-23 15:44:58 -07:00
virt
…
virtio virtio, vhost: fixes, tweaks 2018-08-24 08:45:19 -07:00
visorbus
…
vlynq
…
vme
…
w1 power supply and reset changes for the v4.19 series 2018-08-21 18:06:27 -07:00
watchdog include/linux/compiler*.h: make compiler-*.h mutually exclusive 2018-08-22 17:31:34 -07:00
xen xen/gntdev: fix up blockable calls to mn_invl_range_start 2018-09-14 08:52:30 -04:00
zorro
…
Kconfig
…
Makefile Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00