From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f181.google.com (mail-yw1-f181.google.com [209.85.128.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A37E358381 for ; Sun, 30 Aug 2026 23:22:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788132145; cv=none; b=VlYWOr8ZvaUccSflEE/zYw2G3tK+e/DiPPNHyRuq7rN4sFOXLMiJWOz24yZL4TEkt5c/KHWwCMN8WgjD1bKFWp2ijDcQLrEDGin8mGYcnLTyFKd6YjkdXQDbjKG/hG622A0uj3UuOFG83WmKhGo/Xem0mSHkwUd7Wwhe412wI1o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788132145; c=relaxed/simple; bh=lWdkSLVMrJME+IC4sl1WFmK4U1DvQrIT1XEOvyx3X9M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=l7nSD3wHE7ycZmt8Ri8h7PjqZmXDfZ+ch+OyAWcYnAXBLAbbRfU7BXLjkL/k2OcoVKA/id3qfYNUputVGsHbXLoQCYm1dcHCuSJiksSj5ZzmUPoNPrPcr5LNV5oaw+U3qPdvaomejBJkVdwVYuB0chHbuK48Lgi2GoEyaYidxYo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JTsrHMgF; arc=none smtp.client-ip=209.85.128.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JTsrHMgF" Received: by mail-yw1-f181.google.com with SMTP id 00721157ae682-8630c1503f2so5535847b3.1 for ; Sun, 30 Aug 2026 16:22:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788132143; x=1788736943; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=oDyIKzL6PQfyOtcZdXIqJp7bl04CBybW0yg006Rr6/Q=; b=JTsrHMgF3Sr0E2BdUIqgdWLqVBl6CGEQTO5CbSaBs5JvJ2yFHrUiD09jUGYgoMC/pg 13xtSMJQWrOhHGzDkjslSIH0EE3+sIfbw0rFkGQsJgXL3r5A122PbMhqJawjyY8Fb8yB Ca+iVoLsE2Qe2WGMGjcQWQDmxpDeZ20DpALdaHKQfki05ocWiGc/Bf+DimAevTwS/TJu WyJIkV65Mluvti/7D0EUhEkdwI46VilB2YbTNorWYesNQMGDlp2VSADvey7erA5GqEpN SNJOT4spYvuJmDQeiG3zH7QJq8OOm7b8w2VQT7UkqZ9AxydW7kUwBUi3JWVnVzTvONGX YLfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788132143; x=1788736943; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=oDyIKzL6PQfyOtcZdXIqJp7bl04CBybW0yg006Rr6/Q=; b=FopXJs1/qiu1UikmyWsL+g7u94oh0Xqd+GCz5vS+TgoXF8zHXF6QlFA3aqsTL1jgTK JQyEygDI4zGMDMQ+uhwA4XuE/nxQBsrmrZqELUYz9MwdFsaQASP+WGOf47s5T6Mg3vov B+nJbcKSVoykx205XE4hJYvaNEjszTEcnF7LlVMIoFWlUOAB36MugztOwqV7NvWnCK2B yjiZPtk2H/FHesynIYgi4chtv3Nl2pfv4QWfhydZsk10T+lprg5G6hMyJtgx8Fuq5BjG XSwRp9t6eosaHEh6GyW+PSa0kRDuf3S+j8gOz1KLQ0Z8ZD0zAZTd98wuH7XAGWsKrEVN +AcQ== X-Gm-Message-State: AFuF++lV3UUwsk6rG0LnvQKBE0B6XR/CYbKTHDg0PDdFkeuBYt9FXb/T zKdBWOsPFNS/ZKeWi+Rt238JhGqjZn7wrePKiQd935q2Nt1Ti+eo9aVS X-Gm-Gg: AYBFou2upt8qIlql3zMSpRTQYALRRksKAFKPzOzrPbZ8AnvxCQZmR/ltoZG/gVVXAPy yeRF5Aa1mlx+dASPp8+dwdBdkSl8+bDsNg6rrsxlo3kj/LZwMTBiHumF11GD7/974EBWDDQSRnF xToAiKfr8JEM2l22HQgQUw7/OU0rdEHDBgNr1NRcZOA330LmEi9OfuLvxtygngWtlBtmQ6W8C5d VIeoyKAuL33K5s/0uK82Hm5Y+X5xpdT26Rb/UTb58zxY1DmCq6xiDobogH3HzvkAOjweJ/27zU9 tvnXAsWLO1/R1WL/cwAJdKWdP6N6DSnX6K5whC68cJhpkysuoK3IRo6TddWDaBcuLwDaWyW6tnI DIRhwCW1/RWvn3DT4aQ/6RhfemAgMu5X9c2hSJowLCva6OJSG21OON3Zw+9Npz9I6IMeciLcLsl SYKXlc1n0MHZraOINfDJPjK1b2fX77lzdeui5dbkeLgrQlnKygSY0= X-Received: by 2002:a05:690c:e294:b0:862:65f4:c8c2 with SMTP id 00721157ae682-86726879df3mr283417b3.21.1788132143343; Sun, 30 Aug 2026 16:22:23 -0700 (PDT) Received: from devobuntu.lan ([2600:6c5c:6b00:316::23]) by smtp.gmail.com with ESMTPSA id 00721157ae682-85e677606aesm39025937b3.45.2026.08.30.16.22.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 30 Aug 2026 16:22:22 -0700 (PDT) From: Matt Vollrath To: intel-wired-lan@lists.osuosl.org Cc: netdev@vger.kernel.org, Tony Nguyen , Przemek Kitszel , Alexander Lobakin , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Jonathan Corbet , Shuah Khan , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Matt Vollrath , stable@vger.kernel.org Subject: [PATCH iwl-next 2/8] e1000e: dump pages for jumbo Rx buffers Date: Sun, 30 Aug 2026 19:21:40 -0400 Message-ID: <20260830232146.36948-3-tactii@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260830232146.36948-1-tactii@gmail.com> References: <20260830232146.36948-1-tactii@gmail.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The jumbo Rx path keeps its data in buffer_info->page rather than the skb, which is only a shell. Previously data beyond the end of the skb allocation would be dumped. The jumbo path would at best dump useless garbage. At worst it would dump arbitrary kernel memory. This OOB read is only reachable when page size is >16K and MTU is >1518. Dump the page instead when it exists. Skip dumping the shell skb left behind when a jumbo slot is cleaned. Signed-off-by: Matt Vollrath Fixes: f0c5dadff3fb ("e1000e: fix panic while dumping packets on Tx hang with IOMMU") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-5-fable --- drivers/net/ethernet/intel/e1000e/netdev.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c index 599600ad695c..47ff3c6ab451 100644 --- a/drivers/net/ethernet/intel/e1000e/netdev.c +++ b/drivers/net/ethernet/intel/e1000e/netdev.c @@ -465,8 +465,23 @@ static void e1000e_dump(struct e1000_adapter *adapter) (unsigned long long)buffer_info->dma, buffer_info->skb, next_desc); + /* Jumbo buffers land in the page; a cleaned + * jumbo slot keeps only its small shell skb + * until it is refilled, so only dump an skb + * that can hold a whole buffer. + */ if (netif_msg_pktdata(adapter) && - buffer_info->skb) + buffer_info->page) + print_hex_dump(KERN_INFO, "", + DUMP_PREFIX_ADDRESS, 16, + 1, + page_address(buffer_info->page), + adapter->rx_buffer_len, + true); + else if (netif_msg_pktdata(adapter) && + buffer_info->skb && + skb_tailroom(buffer_info->skb) >= + adapter->rx_buffer_len) print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 1, -- 2.43.0