Public bug reported:
[Impact]
The lan743x driver assembles a received frame that spans more than one RX
buffer by chaining the extra buffers onto the head skb's frag_list. When the
last descriptor arrives, lan743x_rx_trim_skb() linearizes the head skb and
frees the fragment skbs. With RX checksum offload enabled (NETIF_F_RXCSUM, the
default), the driver then sets ip_summed through its local skb pointer. On a
multi-buffer frame that pointer still refers to the final fragment, which has
just been freed, so the driver writes into freed memory.
Multi-buffer receive happens after a live MTU increase, because existing
ring entries keep their old buffer size until they are replenished. The
result is memory corruption in the receive path, and KASAN-enabled
kernels report a use-after-free. BlueField-4 uses a LAN743x device for
its board-level Ethernet port, so the bug is reachable on that platform.
[Fix]
Set ip_summed on the surviving head skb instead of the local skb pointer. For
single-buffer frames the two pointers are the same, so behaviour there does not
change. The fix is in mainline:
a9ce4053dc94 ("net: lan743x: fix RX checksum use-after-free")
https://git.kernel.org/torvalds/c/a9ce4053dc945c5372dedba5017ee675b30dc0c5
Fixes: cd6910501cfd ("net: lan743x: Add support for Rx IP & TCP checksum
offload")
** Affects: linux-nvidia (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171561
Title:
lan743x: use-after-free write in the RX checksum offload path
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-nvidia/+bug/2171561/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
