> -----Original Message-----
> From: Matt Vollrath <[email protected]>
> Sent: Thursday, September 17, 2026 12:52 PM
> To: [email protected]
> Cc: [email protected]; Nguyen, Anthony L
> <[email protected]>; Kitszel, Przemyslaw
> <[email protected]>; Andrew Lunn <[email protected]>;
> David S . Miller <[email protected]>; Eric Dumazet
> <[email protected]>; Jakub Kicinski <[email protected]>; Paolo Abeni
> <[email protected]>; Ben Greear <[email protected]>; Matt
> Vollrath <[email protected]>; [email protected]
> Subject: [PATCH iwl-net v2] e1000e: fix NETIF_F_RXALL buffer overrun
>
> When SBP is set, the card may deliver frames which would otherwise be
> filtered out by LPE being unset. This would allow the device to write
> up to 526 bytes beyond the skb's data allocation: over its own shinfo,
> and beyond. This bug is reachable only when MTU <= 1500 and
> NETIF_F_RXALL is set by ethtool.
>
> To reproduce, build a kernel with CONFIG_SLUB_DEBUG=y and boot with
> slub_debug=FZP. Enable RXALL with 'ethtool -K <iface> rx-all on'.
> Leave MTU at 1500. Directly link with a remote machine and set the
> remote link to MTU 9000. Send oversized frames from the remote machine
> with 'ping -f -M do -s 8972 -p 00'. Unload e1000e on the machine under
> test.
> Observe slub_debug faults in 'dmesg'. If IOMMU is enabled, you may
> also see IOMMU faults during pings.
>
> Fix this by ensuring that buffers are large enough for an entire 2048
> byte chunk when NETIF_F_RXALL is set. Do this by moving final
> rx_buffer_len determination to one place, right before RCTL.BSIZE is
> determined. This will correctly re-evaluate every time the adapter is
> configured, not just on MTU change.
>
> Signed-off-by: Matt Vollrath <[email protected]>
> Suggested-by: Jakub Kicinski <[email protected]>
> Assisted-by: Claude:claude-5-1-fable
> Fixes: cf955e6c96cb ("e1000e: Support RXALL feature flag.")
> Cc: [email protected]
> ---
> v2:
> * Don't make a new function for setting rx_buffer_len.
> * Rewording.
> * Add steps to reproduce.
> ---
> drivers/net/ethernet/intel/e1000e/netdev.c | 41 +++++++++++----------
> -
> 1 file changed, 20 insertions(+), 21 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c
> b/drivers/net/ethernet/intel/e1000e/netdev.c
> index 844f31ab37ad..f31dd5886b09 100644
> --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
> @@ -3094,6 +3094,23 @@ static void e1000_setup_rctl(struct
> e1000_adapter *adapter)
> e1e_wphy(hw, 22, phy_data);
> }
>
> + /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically
> NET_IP_ALIGN
> + * means we reserve 2 more, this pushes us to allocate from the
> next
> + * larger slab size.
> + * i.e. RXBUFFER_2048 --> size-4096 slab
> + * However with the new *_jumbo_rx* routines, jumbo receives
> will use
> + * fragmented skbs
> + */
> + if (adapter->max_frame_size <= 2048)
> + adapter->rx_buffer_len = 2048;
> + else
> + adapter->rx_buffer_len = 4096;
> +
> + /* adjust allocation if LPE protects us, and we aren't using
> SBP */
> + if (adapter->max_frame_size <= (VLAN_ETH_FRAME_LEN +
> ETH_FCS_LEN) &&
> + !(adapter->netdev->features & NETIF_F_RXALL))
> + adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN +
> ETH_FCS_LEN;
> +
> /* Setup buffer sizes */
> rctl &= ~E1000_RCTL_SZ_4096;
> rctl |= E1000_RCTL_BSEX;
> @@ -6079,30 +6096,12 @@ static int e1000_change_mtu(struct net_device
> *netdev, int new_mtu)
>
> pm_runtime_get_sync(netdev->dev.parent);
>
> - if (netif_running(netdev))
> + if (netif_running(netdev)) {
> e1000e_down(adapter, true);
> -
> - /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically
> NET_IP_ALIGN
> - * means we reserve 2 more, this pushes us to allocate from the
> next
> - * larger slab size.
> - * i.e. RXBUFFER_2048 --> size-4096 slab
> - * However with the new *_jumbo_rx* routines, jumbo receives
> will use
> - * fragmented skbs
> - */
> -
> - if (max_frame <= 2048)
> - adapter->rx_buffer_len = 2048;
> - else
> - adapter->rx_buffer_len = 4096;
> -
> - /* adjust allocation if LPE protects us, and we aren't using
> SBP */
> - if (max_frame <= (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN))
> - adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN +
> ETH_FCS_LEN;
> -
> - if (netif_running(netdev))
> e1000e_up(adapter);
> - else
> + } else {
> e1000e_reset(adapter);
> + }
>
> pm_runtime_put_sync(netdev->dev.parent);
>
> --
> 2.43.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
