* [PATCH 2/2] staging: octeon: fix out-of-bounds reads in tx path
2026-09-05 15:35 [PATCH 1/2] staging: octeon: fix use-after-free in tasklet teardown Ayush Mukkanwar
@ 2026-09-05 15:35 ` Ayush Mukkanwar
2026-09-07 16:29 ` [PATCH 1/2] staging: octeon: fix use-after-free in tasklet teardown Greg KH
1 sibling, 0 replies; 3+ messages in thread
From: Ayush Mukkanwar @ 2026-09-05 15:35 UTC (permalink / raw)
To: gregkh
Cc: error27, linux-staging, linux-kernel, linux-kernel-mentees, skhan,
ayushmukkanwar, sashiko-bot
1. cvm_oct_xmit() and cvm_oct_xmit_pow() blindly trust
skb->protocol == htons(ETH_P_IP) and dereference the IP header
without verifying if the packet is long enough or if the header
is in the linear skb data area.
Fix by checking if skb_headlen is larger than
skb_network_offset + size of ip header.
2. cvm_oct_xmit_pow() copies packet data into a fixed size
hardware buffer using a hardcoded memcpy() size. If a packet
is smaller than it, memcpy() will read past the end of the
skb buffer. Fix this by using min_t() so that it does not read
past the end of the skb.
Fixes: 80ff0fd3ab64 ("Staging: Add octeon-ethernet driver files.")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260615172734.42038-1-ayushmukkanwar%40gmail.com
Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
---
Note: This patch has only been compile tested. No runtime testing was
performed as I do not have access to Octeon hardware.
drivers/staging/octeon/ethernet-tx.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/octeon/ethernet-tx.c b/drivers/staging/octeon/ethernet-tx.c
index 5e536827f87a..452bc9fc8a5d 100644
--- a/drivers/staging/octeon/ethernet-tx.c
+++ b/drivers/staging/octeon/ethernet-tx.c
@@ -361,6 +361,8 @@ netdev_tx_t cvm_oct_xmit(struct sk_buff *skb, struct net_device *dev)
/* Check if we can use the hardware checksumming */
if ((skb->protocol == htons(ETH_P_IP)) &&
+ (skb_network_offset(skb) >= 0) &&
+ (skb_network_offset(skb) + sizeof(struct iphdr) <= skb_headlen(skb)) &&
(ip_hdr(skb)->version == 4) &&
(ip_hdr(skb)->ihl == 5) &&
((ip_hdr(skb)->frag_off == 0) ||
@@ -571,6 +573,14 @@ netdev_tx_t cvm_oct_xmit_pow(struct sk_buff *skb, struct net_device *dev)
work->packet_ptr.s.back = (copy_location - packet_buffer) >> 7;
if (skb->protocol == htons(ETH_P_IP)) {
+ if (unlikely(!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr)))) {
+ cvmx_fpa_free(packet_buffer, CVMX_FPA_PACKET_POOL, 0);
+ cvmx_fpa_free(work, CVMX_FPA_WQE_POOL, 1);
+ dev->stats.tx_dropped++;
+ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
work->word2.s.ip_offset = 14;
work->word2.s.tcp_or_udp =
(ip_hdr(skb)->protocol == IPPROTO_TCP) ||
@@ -587,7 +597,7 @@ netdev_tx_t cvm_oct_xmit_pow(struct sk_buff *skb, struct net_device *dev)
* does.
*/
memcpy(work->packet_data, skb->data + 10,
- sizeof(work->packet_data));
+ min_t(unsigned int, skb->len - 10, sizeof(work->packet_data)));
} else {
work->word2.snoip.is_rarp = skb->protocol == htons(ETH_P_RARP);
work->word2.snoip.is_arp = skb->protocol == htons(ETH_P_ARP);
@@ -596,7 +606,8 @@ netdev_tx_t cvm_oct_xmit_pow(struct sk_buff *skb, struct net_device *dev)
work->word2.snoip.is_mcast =
(skb->pkt_type == PACKET_MULTICAST);
work->word2.snoip.not_IP = 1; /* IP was done up above */
- memcpy(work->packet_data, skb->data, sizeof(work->packet_data));
+ memcpy(work->packet_data, skb->data,
+ min_t(unsigned int, skb->len, sizeof(work->packet_data)));
}
/* Submit the packet to the POW */
--
2.54.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH 1/2] staging: octeon: fix use-after-free in tasklet teardown
2026-09-05 15:35 [PATCH 1/2] staging: octeon: fix use-after-free in tasklet teardown Ayush Mukkanwar
2026-09-05 15:35 ` [PATCH 2/2] staging: octeon: fix out-of-bounds reads in tx path Ayush Mukkanwar
@ 2026-09-07 16:29 ` Greg KH
1 sibling, 0 replies; 3+ messages in thread
From: Greg KH @ 2026-09-07 16:29 UTC (permalink / raw)
To: Ayush Mukkanwar
Cc: error27, linux-staging, linux-kernel, linux-kernel-mentees, skhan,
sashiko-bot
On Sat, Sep 05, 2026 at 09:05:29PM +0530, Ayush Mukkanwar wrote:
> cvm_oct_tx_shutdown() kills the tx cleanup tasklet while
> the net devices are still registered. This could lead
> to use-after-free when a tasklet is scheduled after the
> tasklet_kill() is called which might run after the net
> devices are freed.
> Fix it by unregistering the net devices before the tasklet
> is killed.
>
> Fixes: 4898c560103f ("Staging: Octeon: Free transmit SKBs in a timely manner")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/message/20260615172734.42038-1-ayushmukkanwar%40gmail.com
> Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
> ---
> Note: This patch has only been compile tested. No runtime testing was
> performed as I do not have access to Octeon hardware.
Please wait until you have the hardware, as the sashiko review comments
say there are still issues with this patch series :(
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread