In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: stmmac: fix rx Scatter-Gather support<\/p>\n
When a received frame is larger than dma_buf_sz, the DMA scatters it
\nacross multiple RX descriptors (rx Scatter-Gather). The secondary RX
\nbuffer (sec_page) was only allocated and programmed when split-header
\n(SPH) was active, so for regular frames buffer2 was neither allocated
\nnor backed by a valid mapping. As soon as an incoming frame overflowed
\nbuffer1, the DMA wrote the overflow into the unmapped secondary-buffer
\naddress, triggering an SMMU translation fault on IOMMU-based platforms:<\/p>\n
arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x7f0011, cbfrsynra=0x1c90, cb=11
\narm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x1c90
\narm-smmu 15000000.iommu: FSYNR0 = 007f0011 [S1CBNDX=127 WNR PLVL=1]<\/p>\n
Enable scatter-gather for non-SPH frames on cores that can program an
\nindependent secondary RX buffer (GMAC4\/XGMAC): allocate and mark buffer2
\nas valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and account
\nfor it in the buffer length computation. Legacy cores have no set_sec_addr
\nop, so they keep buffer2 disabled.<\/p>\n
Since buffer2 is handed to the DMA at page offset 0, the page pool sync
\nwindow is widened to cover both buffers in every mode: offset is set to 0
\nand max_len to dma_buf_sz + stmmac_rx_offset().<\/p>\n
The FCS can straddle the buffer1\/buffer2 boundary and a descriptor
\nboundary, so it is now stripped from the tail of the assembled frame with
\npskb_trim() instead of from a single buffer, avoiding an unsigned underflow
\nfor frames that overflow a buffer by 1..3 bytes. For single-buffer frames
\nthe XDP program must not see the FCS, so it is removed from the XDP buffer
\nbefore the program runs.<\/p>\n
Native XDP currently only supports single-buffer (linear) frames. An
\noversized frame accepted by the MAC (jumbo enabled) is received via
\nbuffer2; the XDP program only sees buffer1, so on a TX\/REDIRECT verdict
\nthe frame is forwarded truncated. XDP multi-buffer support to handle
\nthis case is planned as a follow-up.<\/p>\n
AF_XDP zero-copy RX is not covered by this change: a ZC queue still
\nprograms buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit),
\nso an oversized frame overflowing buffer1 can still trigger the same
\nSMMU translation fault. Handling is planned as a follow-up.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: stmmac: fix rx Scatter-Gather support<\/p>\n
When a received frame is larger than dma_buf_sz, the DMA scatters it
\nacross multiple RX<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41275","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41275","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41275"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41275"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}