From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24A5FC47254 for ; Fri, 8 May 2020 13:13:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E1B5C249A5 for ; Fri, 8 May 2020 13:13:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588943589; bh=+eu7PDIcnxjJ0UsZQxg1LtGjttTgz0EEIalbJfwifiE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=om7BMYdUrNqOTEGkuv0wsj8/X18Xm3PT2PLJhKDrhYjUIlrOo3/eAcid8W7FbKlLU 3118IMraJsV7xDDb+UGvFSeF7G+/sGnuJldGqlsaYXf8odYTHGsXD+dswDueCqqBbw /vmRzgcmy/PdkQLqCRVutvXQpLYvgOWd0QBEXRvs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729122AbgEHNNH (ORCPT ); Fri, 8 May 2020 09:13:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:51762 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728736AbgEHMsO (ORCPT ); Fri, 8 May 2020 08:48:14 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 73E1D2145D; Fri, 8 May 2020 12:48:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588942093; bh=+eu7PDIcnxjJ0UsZQxg1LtGjttTgz0EEIalbJfwifiE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rCDm0kSKDKLfL72MU33Yoqm7LOPUjTaTgAkD85o98JNAKDhY+6mDsP4Z5sBcNFdAZ JKOTLDaAtk5LWTTyIKXDdnJcAWC6rA77fk/PYA8iu3QYt5HttfxVxkwCkEsNhdtQPm j38tP/uNI7v3NTCFOP95knG0LXDaD6D711pgXtIA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nicolas Schichan , Philipp Kirchhofer , "David S. Miller" Subject: [PATCH 4.4 294/312] net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets. Date: Fri, 8 May 2020 14:34:45 +0200 Message-Id: <20200508123145.044031109@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200508123124.574959822@linuxfoundation.org> References: <20200508123124.574959822@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nicolas Schichan commit 3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8 upstream. The code in txq_put_data() would use txq->tx_curr_desc to index the tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned fragments, which is already moved to the next descriptor at the beginning of the function. If that fragment was the last of the the skb, the next skb would use that same space to place the ip headers, overwritting that small fragment data. Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path) Signed-off-by: Nicolas Schichan Reviewed-by: Philipp Kirchhofer Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/marvell/mv643xx_eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/marvell/mv643xx_eth.c +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c @@ -762,10 +762,10 @@ txq_put_data_tso(struct net_device *dev, if (length <= 8 && (uintptr_t)data & 0x7) { /* Copy unaligned small data fragment to TSO header data area */ - memcpy(txq->tso_hdrs + txq->tx_curr_desc * TSO_HEADER_SIZE, + memcpy(txq->tso_hdrs + tx_index * TSO_HEADER_SIZE, data, length); desc->buf_ptr = txq->tso_hdrs_dma - + txq->tx_curr_desc * TSO_HEADER_SIZE; + + tx_index * TSO_HEADER_SIZE; } else { /* Alignment is okay, map buffer and hand off to hardware */ txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;