RE: [PATCH net v2] net: fec: reject oversized fragments before bounce-buffer memcpy

[Wei Fang]

> fec_enet_txq_submit_frag_skb() and fec_enet_txq_submit_skb() copy
> transmit data into a per-ring bounce buffer when the source address is
> misaligned or the FEC_QUIRK_SWAP_FRAME quirk is active. The bounce
> buffers are allocated as kmalloc(FEC_ENET_TX_FRSIZE) where
> FEC_ENET_TX_FRSIZE is 2048 bytes.
> 
> However, skb_frag_size() can return up to PAGE_SIZE (4096 on most
> architectures) for scatter-gather fragments, and skb_headlen() can
> exceed 2048 for certain GSO packets. When this happens the memcpy
> overflows the bounce buffer by up to 2048 bytes, corrupting adjacent
> heap objects.
> 
> Add a length check before each bounce-buffer copy. If the data exceeds
> the bounce buffer capacity, fall through to the error path rather than
> performing the out-of-bounds write.
> 
> Fixes: 6605b730c061 ("FEC: Add alignment handling for FEC driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>
> ---
>  drivers/net/ethernet/freescale/fec_main.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/ethernet/freescale/fec_main.c
> b/drivers/net/ethernet/freescale/fec_main.c
> index 794ec42..8614984 100644
> --- a/drivers/net/ethernet/freescale/fec_main.c
> +++ b/drivers/net/ethernet/freescale/fec_main.c
> @@ -558,6 +558,8 @@ fec_enet_txq_submit_frag_skb(struct
> fec_enet_priv_tx_q *txq,
>  		index = fec_enet_get_bd_index(bdp, &txq->bd);
>  		if (((unsigned long) bufaddr) & fep->tx_align ||
>  			fep->quirks & FEC_QUIRK_SWAP_FRAME) {
> +			if (frag_len > FEC_ENET_TX_FRSIZE)
> +				goto dma_mapping_error;
>  			memcpy(txq->tx_bounce[index], bufaddr, frag_len);
>  			bufaddr = txq->tx_bounce[index];
> 
> @@ -634,6 +636,8 @@ static int fec_enet_txq_submit_skb(struct
> fec_enet_priv_tx_q *txq,
>  	index = fec_enet_get_bd_index(bdp, &txq->bd);
>  	if (((unsigned long) bufaddr) & fep->tx_align ||
>  		fep->quirks & FEC_QUIRK_SWAP_FRAME) {
> +		if (buflen > FEC_ENET_TX_FRSIZE)
> +			goto release;

Where is the 'release' label, I could not find it in latest net tree.

Also, do not repost a new version within 24 hours.
https://elixir.bootlin.com/linux/v7.3-rc3/source/Documentation/process/maintainer-netdev.rst#L15