From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C01B3C43381 for ; Wed, 27 Feb 2019 08:59:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8F239218CD for ; Wed, 27 Feb 2019 08:59:12 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="KCkBif3V" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729249AbfB0I7L (ORCPT ); Wed, 27 Feb 2019 03:59:11 -0500 Received: from mail-pg1-f194.google.com ([209.85.215.194]:41360 "EHLO mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726031AbfB0I7L (ORCPT ); Wed, 27 Feb 2019 03:59:11 -0500 Received: by mail-pg1-f194.google.com with SMTP id m1so7631423pgq.8 for ; Wed, 27 Feb 2019 00:59:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id; bh=V0kpczv6IDUE6Os49zwyNVWt2u7llv5EwmG0reKfLZc=; b=KCkBif3VPvaeWfrUFa1VFapcWuqKg2aIVJWDdxNNTO5atkUa/sfEOj1c6bcpl248j3 bS/6pua8vBLAt8RzdvpXhJ8Y3PL3wX8Ksq/rDa+44ClkLnNCMticWtGBmy234i77uPsl yvLOErj/QbzhR7m9b9QToqe+pIgi9hvyRmSyg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=V0kpczv6IDUE6Os49zwyNVWt2u7llv5EwmG0reKfLZc=; b=O7FfmxQW02cOTVCNyeRbyRJ7N07kdS4BfMlrcNz4S5CiExgvuuMiBZ4sbaoQpP9FRR eA8MDlES/M5xNqS8GeFublqQuVsb80iq52cXtmP2AI5lNiSULwyFjCXSaiR30fq/i0bB XA0v04+CxJ6qKlLmqwct189uqVLXLv6r0BDgLBAfHgfbXsvWBRWKIeXeqvq5j7L7aLt8 /QBp8M9Uo8wZV5vpoYLHSlBU0sQJOZ+jjIryvRLzZUYY3QjrpzmJE/RfrfzcD4irVBm9 AbH140Nx6/d0M40BYhZ4RYOaGrunibwNIRdxYQGq7ye56O2CI7PorNL0IKRBmczI/oCj Xnrw== X-Gm-Message-State: AHQUAuaB0VpvvbAMDA3owsc1mtiSMfDTwK5fDshygeg6oMpW/oGpwWqK 3N42ZCCMihjNNrD0IjiC/uh0qLG8LpE= X-Google-Smtp-Source: AHgI3Ib5SExKzLhy1WnTqVJE8T1Ghs7DWVON82FOwTMfkl9+ubK7wDjr/C5q07qDToKLF3sbrBhqRw== X-Received: by 2002:a65:47cb:: with SMTP id f11mr1979532pgs.18.1551257950565; Wed, 27 Feb 2019 00:59:10 -0800 (PST) Received: from localhost.dhcp.broadcom.net ([192.19.223.250]) by smtp.gmail.com with ESMTPSA id n74sm26137810pfb.188.2019.02.27.00.59.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Feb 2019 00:59:10 -0800 (PST) From: Michael Chan To: davem@davemloft.net Cc: netdev@vger.kernel.org Subject: [PATCH net] bnxt_en: Drop oversize TX packets to prevent errors. Date: Wed, 27 Feb 2019 03:58:53 -0500 Message-Id: <1551257933-13270-1-git-send-email-michael.chan@broadcom.com> X-Mailer: git-send-email 1.8.3.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org There have been reports of oversize UDP packets being sent to the driver to be transmitted, causing error conditions. The issue is likely caused by the dst of the SKB switching between 'lo' with 64K MTU and the hardware device with a smaller MTU. Patches are being proposed by Mahesh Bandewar to fix the issue. In the meantime, add a quick length check in the driver to prevent the error. The driver uses the TX packet size as index to look up an array to setup the TX BD. The array is large enough to support all MTU sizes supported by the driver. The oversize TX packet causes the driver to index beyond the array and put garbage values into the TX BD. Add a simple check to prevent this. Signed-off-by: Michael Chan --- David, I think this should be queued for stable as well. drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index d95730c..803f799 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -500,6 +500,12 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) } length >>= 9; + if (unlikely(length >= ARRAY_SIZE(bnxt_lhint_arr))) { + dev_warn_ratelimited(&pdev->dev, "Dropped oversize %d bytes TX packet.\n", + skb->len); + i = 0; + goto tx_dma_error; + } flags |= bnxt_lhint_arr[length]; txbd->tx_bd_len_flags_type = cpu_to_le32(flags); -- 2.5.1