In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: stmmac: fix TX descriptor availability check for TSO traffic<\/p>\n
stmmac_tso_xmit() estimates the number of free TX descriptors required by
\na TSO skb as:<\/p>\n
\t(skb->len – proto_hdr_len) \/ TSO_MAX_BUFF_SIZE + 1<\/p>\n
which assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This
\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),
\nsince each fragment is mapped individually and so it needs at least one
\ndescriptor regardless of its size. Moreover, one descriptor is used for
\nthe L2\/L3\/L4 headers and, when the MSS changes, one more is consumed for
\nthe MSS context descriptor.
\nFor a highly fragmented TSO skb the check can therefore pass even when the
\nring has too few free slots. stmmac_tso_allocator() then writes past the
\navailable descriptors, overwriting descriptors still owned by the DMA
\nengine, corrupting the TX ring.
\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors
\nneeded for the header, the linear payload and each fragment, plus the MSS
\ncontext descriptor when required, and use it in the availability check.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: stmmac: fix TX descriptor availability check for TSO traffic<\/p>\n
stmmac_tso_xmit() estimates the number of free TX descriptors re<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29109","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}