Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net: amd-xgbe: Fix skb data length underflow

There will be BUG_ON() triggered in include/linux/skbuff.h leading to
intermittent kernel panic, when the skb length underflow is detected.

Fix this by dropping the packet if such length underflows are seen
because of inconsistencies in the hardware descriptors.

Fixes: 622c36f143fc ("amd-xgbe: Fix jumbo MTU processing on newer hardware")
Suggested-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20220127092003.2812745-1-Shyam-sundar.S-k@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Shyam Sundar S K and committed by
Jakub Kicinski
5aac9108 23a46422

+11 -1
+11 -1
drivers/net/ethernet/amd/xgbe/xgbe-drv.c
··· 2550 2550 buf2_len = xgbe_rx_buf2_len(rdata, packet, len); 2551 2551 len += buf2_len; 2552 2552 2553 + if (buf2_len > rdata->rx.buf.dma_len) { 2554 + /* Hardware inconsistency within the descriptors 2555 + * that has resulted in a length underflow. 2556 + */ 2557 + error = 1; 2558 + goto skip_data; 2559 + } 2560 + 2553 2561 if (!skb) { 2554 2562 skb = xgbe_create_skb(pdata, napi, rdata, 2555 2563 buf1_len); ··· 2587 2579 if (!last || context_next) 2588 2580 goto read_again; 2589 2581 2590 - if (!skb) 2582 + if (!skb || error) { 2583 + dev_kfree_skb(skb); 2591 2584 goto next_packet; 2585 + } 2592 2586 2593 2587 /* Be sure we don't exceed the configured MTU */ 2594 2588 max_len = netdev->mtu + ETH_HLEN;