r8169: fix crash when large packets are received [Linux 2.6.30]

This Linux kernel change "r8169: fix crash when large packets are received" is included in the Linux 2.6.30 release. This change is authored by Eric Dumazet <eric.dumazet [at] gmail.com> on Tue Jun 9 04:01:02 2009 -0700. The commit for this change in Linux stable tree is fdd7b4c (patch).

r8169: fix crash when large packets are received

Michael Tokarev reported receiving a large packet could crash
a machine with RTL8169 NIC.
( original thread at http://lkml.org/lkml/2009/6/8/192 )

Problem is this driver tells that NIC frames up to 16383 bytes
can be received but provides skb to rx ring allocated with
smaller sizes (1536 bytes in case standard 1500 bytes MTU is used)

When a frame larger than what was allocated by driver is received,
dma transfert can occurs past the end of buffer and corrupt
kernel memory.

Fix is to tell to NIC what is the maximum size a frame can be.

This bug is very old, (before git introduction, linux-2.6.10), and
should be backported to stable versions.

Reported-by: Michael Tokarev <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Tested-by: Michael Tokarev <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

There are 11 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/net/r8169.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 8247a94..3b19e0c 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -66,7 +66,6 @@
 #define RX_DMA_BURST   6   /* Maximum PCI burst, '6' is 1024 */
 #define TX_DMA_BURST   6   /* Maximum PCI burst, '6' is 1024 */
 #define EarlyTxThld    0x3F    /* 0x3F means NO early transmit */
-#define RxPacketMaxSize    0x3FE8  /* 16K - 1 - ETH_HLEN - VLAN - CRC... */
 #define SafeMtu        0x1c20  /* ... actually life sucks beyond ~7k */
 #define InterFrameGap  0x03    /* 3 means InterFrameGap = the shortest one */

@@ -2357,10 +2356,10 @@ static u16 rtl_rw_cpluscmd(void __iomem *ioaddr)
    return cmd;
 }

-static void rtl_set_rx_max_size(void __iomem *ioaddr)
+static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
 {
    /* Low hurts. Let's disable the filtering. */
-   RTL_W16(RxMaxSize, 16383);
+   RTL_W16(RxMaxSize, rx_buf_sz);
 }

 static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
@@ -2407,7 +2406,7 @@ static void rtl_hw_start_8169(struct net_device *dev)

    RTL_W8(EarlyTxThres, EarlyTxThld);

-   rtl_set_rx_max_size(ioaddr);
+   rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);

    if ((tp->mac_version == RTL_GIGA_MAC_VER_01) ||
        (tp->mac_version == RTL_GIGA_MAC_VER_02) ||
@@ -2668,7 +2667,7 @@ static void rtl_hw_start_8168(struct net_device *dev)

    RTL_W8(EarlyTxThres, EarlyTxThld);

-   rtl_set_rx_max_size(ioaddr);
+   rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);

    tp->cp_cmd |= RTL_R16(CPlusCmd) | PktCntrDisable | INTT_1;

@@ -2846,7 +2845,7 @@ static void rtl_hw_start_8101(struct net_device *dev)

    RTL_W8(EarlyTxThres, EarlyTxThld);

-   rtl_set_rx_max_size(ioaddr);
+   rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);

    tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;

Leave a Reply

Your email address will not be published. Required fields are marked *