RE: [PATCH] drivers: net: axienet: safely drop oversized RX frames

From: Gupta, Suraj <hidden>
Date: 2025-05-09 06:09:06
Also in: lkml, netdev

[AMD Official Use Only - AMD Internal Distribution Only]

-----Original Message-----
From: Can Ayberk Demir <redacted>
Sent: Thursday, May 8, 2025 8:34 PM
To: netdev@vger.kernel.org
Cc: Pandey, Radhey Shyam <radhey.shyam.pandey@amd.com>; Andrew Lunn
[off-list ref]; David S . Miller [off-list ref]; Eric
Dumazet [off-list ref]; Jakub Kicinski [off-list ref]; Paolo
Abeni [off-list ref]; Simek, Michal [off-list ref]; linux-arm-
kernel@lists.infradead.org; linux-kernel@vger.kernel.org; Can Ayberk DEMIR
[off-list ref]
Subject: [PATCH] drivers: net: axienet: safely drop oversized RX frames

Caution: This message originated from an External Source. Use proper caution
when opening attachments, clicking links, or responding.

From: Can Ayberk DEMIR <redacted>

In AXI Ethernet (axienet) driver, receiving an Ethernet frame larger than the allocated
skb buffer may cause memory corruption or kernel panic, especially when the
interface MTU is small and a jumbo frame is received.

Signed-off-by: Can Ayberk DEMIR <redacted>
---
 .../net/ethernet/xilinx/xilinx_axienet_main.c | 46 +++++++++++--------
 1 file changed, 27 insertions(+), 19 deletions(-)



Please fix alignment and coding styles, some of them reported by checkpatch:

CHECK: Alignment should match open parenthesis
#46: FILE: drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1228:
+                               netdev_warn(ndev,
+                                               "Dropping oversized RX frame (len=%u, tailroom=%u)\n",

ERROR: space required before the open brace '{'
#50: FILE: drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1232:
+                       }else{

ERROR: space required after that close brace '}'
#50: FILE: drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1232:
+                       }else{

CHECK: Alignment should match open parenthesis
#61: FILE: drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1243:
+                                       if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
+                                               csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {

total: 2 errors, 0 warnings, 2 checks, 55 lines checked

FYR: https://www.kernel.org/doc/html/v4.10/process/coding-style.html

quoted hunk ↗ jump to hunk

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c

b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 1b7a653c1f4e..a74ac8fe8ea8 100644

--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c

@@ -1223,28 +1223,36 @@ static int axienet_rx_poll(struct napi_struct *napi, int

budget)
                        dma_unmap_single(lp->dev, phys, lp->max_frm_size,
                                         DMA_FROM_DEVICE);

-                       skb_put(skb, length);
-                       skb->protocol = eth_type_trans(skb, lp->ndev);
-                       /*skb_checksum_none_assert(skb);*/
-                       skb->ip_summed = CHECKSUM_NONE;
-
-                       /* if we're doing Rx csum offload, set it up */
-                       if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
-                               csumstatus = (cur_p->app2 &
-                                             XAE_FULL_CSUM_STATUS_MASK) >> 3;
-                               if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
-                                   csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
-                                       skb->ip_summed = CHECKSUM_UNNECESSARY;
+                       if (unlikely(length > skb_tailroom(skb))) {
+                               netdev_warn(ndev,
+                                               "Dropping oversized RX frame (len=%u,
tailroom=%u)\n",
+                                               length, skb_tailroom(skb));
+                               dev_kfree_skb(skb);
+                               skb = NULL;
+                       }else{
+                               skb_put(skb, length);
+                               skb->protocol = eth_type_trans(skb, lp->ndev);
+                               /*skb_checksum_none_assert(skb);*/
+                               skb->ip_summed = CHECKSUM_NONE;
+
+                               /* if we're doing Rx csum offload, set it up */
+                               if (lp->features & XAE_FEATURE_FULL_RX_CSUM) {
+                                       csumstatus = (cur_p->app2 &
+                                                       XAE_FULL_CSUM_STATUS_MASK) >> 3;
+                                       if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED ||
+                                               csumstatus == XAE_IP_UDP_CSUM_VALIDATED) {
+                                               skb->ip_summed = CHECKSUM_UNNECESSARY;
+                                       }
+                               } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM)
{
+                                       skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
+                                       skb->ip_summed =
+ CHECKSUM_COMPLETE;
                                }
-                       } else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) {
-                               skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF);
-                               skb->ip_summed = CHECKSUM_COMPLETE;
-                       }

-                       napi_gro_receive(napi, skb);
+                               napi_gro_receive(napi, skb);

-                       size += length;
-                       packets++;
+                               size += length;
+                               packets++;
+                       }
                }

                new_skb = napi_alloc_skb(napi, lp->max_frm_size);
--
2.39.5 (Apple Git-154)

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help