A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/net/dsa
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jakob Unterwurzacher 26dc498a9f net: dsa: microchip: linearize skb for tail-tagging switches 
[ Upstream commit ba54bce747fa9e07896c1abd9b48545f7b4b31d2 ]

The pointer arithmentic for accessing the tail tag only works
for linear skbs.

For nonlinear skbs, it reads uninitialized memory inside the
skb headroom, essentially randomizing the tag. I have observed
it gets set to 6 most of the time.

Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6
(which does not exist for the ksz9896 that's in use), dropping the packet.
Debug prints added by me (not included in this patch):

	[  256.645337] ksz9477_rcv:323 tag0=6
	[  256.645349] skb len=47 headroom=78 headlen=0 tailroom=0
	               mac=(64,14) mac_len=14 net=(78,0) trans=78
	               shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))
	               csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0)
	               hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3
	               priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0
	               encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
	[  256.645377] dev name=end1 feat=0x0002e10200114bb3
	[  256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	[  256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06
	[  256.645428] skb frag:     00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02
	[  256.645436] skb frag:     00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00
	[  256.645444] skb frag:     00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
	[  256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL

Call skb_linearize before trying to access the tag.

This patch fixes ksz9477_rcv which is used by the ksz9896 I have at
hand, and also applies the same fix to ksz8795_rcv which seems to have
the same problem.

Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
CC: stable@vger.kernel.org
Fixes: 016e43a26b ("net: dsa: ksz: Add KSZ8795 tag code")
Fixes: 8b8010fb78 ("dsa: add support for Microchip KSZ tail tagging")
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://patch.msgid.link/20250515072920.2313014-1-jakob.unterwurzacher@cherry.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-09 18:44:00 +02:00
..
dsa.c net: dsa: add GRO support via gro_cells 2021-03-11 14:06:48 +01:00
dsa2.c net: dsa: Add missing of_node_put() in dsa_port_parse_of 2022-03-23 09:12:07 +01:00
dsa_priv.h net: dsa: add GRO support via gro_cells 2021-03-11 14:06:48 +01:00
Kconfig net: dsa: add GRO support via gro_cells 2021-03-11 14:06:48 +01:00
Makefile net: dsa: microchip: remove NET_DSA_TAG_KSZ_COMMON 2019-09-12 11:36:12 +01:00
master.c net: dsa: fix a crash if ->get_sset_count() fails 2021-06-03 08:59:07 +02:00
port.c net: dsa: Don't instantiate phylink for CPU/DSA ports unless needed 2020-03-18 07:17:47 +01:00
slave.c net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup 2021-09-22 12:26:42 +02:00
switch.c net: dsa: program VLAN on CPU port from slave 2019-08-27 20:17:28 -07:00
tag_8021q.c net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop 2020-04-01 11:01:34 +02:00
tag_brcm.c net: dsa: Fix duplicate frames flooded by learning 2020-04-01 11:01:33 +02:00
tag_dsa.c
tag_edsa.c dsa: Allow forwarding of redirected IGMP traffic 2020-09-23 12:40:33 +02:00
tag_gswip.c net: dsa: tag_gswip: fix typo in tagger name 2020-01-23 08:22:52 +01:00
tag_ksz.c net: dsa: microchip: linearize skb for tail-tagging switches 2025-09-09 18:44:00 +02:00
tag_lan9303.c
tag_mtk.c net: dsa: tag_mtk: fix 802.1ad VLAN egress 2021-03-20 10:39:47 +01:00
tag_qca.c net: dsa: tag_qca: Make sure there is headroom for tag 2020-02-24 08:36:22 +01:00
tag_sja1105.c net: dsa: tag_sja1105: fix MAC DA patching from meta frames 2023-07-27 08:37:24 +02:00
tag_trailer.c