github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: lan966x: do not inject uninitialised bytes past skb->len

Browse Source 
lan966x_port_ifh_xmit() writes the frame to the injection FIFO one
32-bit word at a time, and pads frames shorter than 60 bytes with zero
words.

Before this patch, the last word is loaded whole even when skb->len is
not a multiple of four, so 1 to 3 bytes past the end of the frame are
read. For a frame shorter than 60 bytes those bytes are also
transmitted, as VLD_BYTES marks the whole last word valid and the
padding starts at the next word.

Write the trailing bytes from a zeroed word. The number of words written
and VLD_BYTES are unchanged.

Found by an AI code review agent. Reproduced on a lan9668 board with
register injection, by sending a
57 byte frame and capturing it on the link partner: byte 57 of the
padded frame was not zero. With the fix all padding bytes are zero.

Fixes: d28d6d2e37 ("net: lan966x: add port module support")
Signed-off-by: Daniel Machon <daniel.machon@microchip.com>
Link: https://patch.msgid.link/20261026-lan966x-inject-tail-bytes-v1-1-51d599a48313@microchip.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Daniel Machon 2026-10-26 14:46:15 +01:00 committed by Paolo Abeni
parent f75062536e
commit b4a7180558
1 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/net/ethernet/microchip/lan966x/lan966x_main.c
View File

@ -263,9 +263,8 @@ static int lan966x_port_ifh_xmit(struct sk_buff *skb,
lan_wr((__force u32)ifh[i], lan966x, QS_INJ_WR(grp));
}
/* Write frame */
count = DIV_ROUND_UP(skb->len, 4);
last = skb->len % 4;
/* Write the whole words of the frame */
count = skb->len / 4;
for (i = 0; i < count; ++i) {
/* Wait until the fifo is ready */
err = lan966x_port_inj_ready(lan966x, grp);
@ -275,6 +274,20 @@ static int lan966x_port_ifh_xmit(struct sk_buff *skb,
lan_wr(((u32 *)skb->data)[i], lan966x, QS_INJ_WR(grp));
}
/* Write the last 1 to 3 bytes, zero padded to a whole word */
last = skb->len % 4;
if (last) {
/* Wait until the fifo is ready */
err = lan966x_port_inj_ready(lan966x, grp);
if (err)
goto err;
val = 0;
memcpy(&val, skb->data + count * 4, last);
lan_wr(val, lan966x, QS_INJ_WR(grp));
++i;
}
/* Add padding */
while (i < (LAN966X_BUFFER_MIN_SZ / 4)) {
/* Wait until the fifo is ready */