In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: spacemit: clear TX descriptor on fragment mapping failure<\/p>\n
emac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for
\nevery slot beyond old_head as soon as that slot’s memset()’d local
\ncopy is committed with “*tx_desc_addr = tx_desc”, i.e. before the
\nbuffers for that slot have necessarily all been mapped successfully.
\nIf emac_tx_map_frag() then fails on a later fragment, the err_free_skb
\npath calls emac_free_tx_buf() to unmap and drop the skb, but leaves
\nthe already-written descriptor memory untouched, and tx_ring->head is
\nnever advanced past old_head (the “tx_ring->head = head” store is
\nskipped by the goto).<\/p>\n
So a slot between old_head and the rolled-back head can be left with
\nTX_DESC_0_OWN set and buffer_addr_{1,2} pointing at DMA mappings that
\nemac_free_tx_buf() just tore down, while software considers that slot
\nfree again. The next successful emac_tx_mem_map() call only rebuilds
\nold_head itself; if the DMA engine auto-advances into the following
\ndescriptor once it finishes old_head’s packet, it will fetch that
\nstale, already-unmapped address.<\/p>\n
emac_tx_clean_desc() already treats emac_free_tx_buf() and clearing
\nthe descriptor as a pair when reclaiming completed descriptors; do
\nthe same in the mapping failure path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: spacemit: clear TX descriptor on fragment mapping failure<\/p>\n
emac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41064","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}