From 8ca2735ad84900ce184f232bb4f7b6acab7a1c1b Mon Sep 17 00:00:00 2001 From: Esben Haabendal Date: Thu, 9 Sep 2021 22:14:32 +0800 Subject: [PATCH] net: ll_temac: Fix bug causing buffer descriptor overrun commit:9c15b8f95503616638663f58ddac2ad354c743fc CVE:CVE-2021-38207 Signed-off-by: wanxiaoqing --------------------------- mainline inclusion from mainline-v5.2-rc1 commit 2c9938e738a273ba315679781a9990c7d3b1831b category: bugfix issue: #I49DWW CVE: CVE-2021-38207 --------------------------- As we are actually using a BD for both the skb and each frag contained in it, the oldest TX BD would be overwritten when there was exactly one BD less than needed. Signed-off-by: Esben Haabendal Signed-off-by: David S. Miller Signed-off-by: Yang Yingliang Reviewed-by: Yue Haibing Reviewed-by: Xiu Jianfeng Signed-off-by: Yang Yingliang Signed-off-by: Yu Changchun Signed-off-by: wanxiaoqing --- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c index 2241f9897092..88e71aa89092 100644 --- a/drivers/net/ethernet/xilinx/ll_temac_main.c +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c @@ -689,7 +689,7 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) start_p = lp->tx_bd_p + sizeof(*lp->tx_bd_v) * lp->tx_bd_tail; cur_p = &lp->tx_bd_v[lp->tx_bd_tail]; - if (temac_check_tx_bd_space(lp, num_frag)) { + if (temac_check_tx_bd_space(lp, num_frag + 1)) { if (!netif_queue_stopped(ndev)) netif_stop_queue(ndev); return NETDEV_TX_BUSY; -- Gitee