From nobody Mon May 09 13:46:48 2022 X-Original-To: net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 0AD881AC0705 for ; Mon, 9 May 2022 13:46:49 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KxjBw5rJTz3sNl for ; Mon, 9 May 2022 13:46:48 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A3AAF123A4 for ; Mon, 9 May 2022 13:46:48 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 249DkmMW092823 for ; Mon, 9 May 2022 13:46:48 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from bugzilla@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 249Dkmds092822 for net@FreeBSD.org; Mon, 9 May 2022 13:46:48 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: bugzilla set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 263824] genet(4): Driver interface may overwrite memory in a consecutive memory copy operations when parsing TX packet Date: Mon, 09 May 2022 13:46:48 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: bin X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: needs-qa, security X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: commit-hook@FreeBSD.org X-Bugzilla-Status: In Progress X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: karels@freebsd.org X-Bugzilla-Flags: maintainer-feedback? mfc-stable13? mfc-stable12? X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1652104008; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AszORyys+SD+tNFbb9XTCmvVeNq1scW5Rq3iXRNKx+U=; b=QLDuuGJ1InO+39HGUpftTyYqbCBkZk3mUaIVHONdqwd2ae4v3PdUDURk96Q857bijXitVH rL+gdcBZ8Ahw/ZOpHVBCqCEbdO146orxR9am1AejGWBYmSOkEICRPJ40LoaVPJv3R5lYmH vrfKQVR8Zb+c0ydlTu+iegRLKh4AfR03XF3fgBj7Dt1umI1HNyehDDy5u4M5ugC6CdKvD8 dzfVeXNKREBPVxntIEy7n+/S27m7qpRlrX3XDGOLFAQi8ZmmOu6Dzj8AicmXTS0vdZSYpy jY1LxVrAOFKjwJz1brKalNJ2OAH9ser3TzT4ntYlxcRYBQDln3L76qVMnhU1nw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1652104008; a=rsa-sha256; cv=none; b=P4rJRBgVVvzDT0Lv9uU1gaRtxSsl2rU9h+y/vh3CruSDAotERJVXNxm4CMv40ZOl4tHTIG w/8ByXAnZuZTPKUj/nuyvQ8k/7AHIkNABe6mEu+f5Xk7g81s0MuC4M02Z9BmkPK1uqvAIq xPELjPvrTZfvDq74xSnlDjgU234jNlsJmq7qjDdlwEG6rBsPRLMJkPtNuBeLx8eKrkzLjt 0LoS0k0YmJlssc9dVe0kNGZFBShHrzfPho1TBoiTXkBCczM3Hym/2ucqfT2c6Tiv/HPwlB DW+j0M3EA4jLevUbpYQL7ZlLzv6UUjWxjBDeGGniyofJwUT8EO229rCPEpqGkg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D263824 --- Comment #5 from commit-hook@FreeBSD.org --- A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3D1de9aa4d4f7938f36e6485dad817908a6= e45bb32 commit 1de9aa4d4f7938f36e6485dad817908a6e45bb32 Author: Mike Karels AuthorDate: 2022-05-09 12:19:52 +0000 Commit: Mike Karels CommitDate: 2022-05-09 13:46:06 +0000 genet: fix output packet corruption in uncommon case The code for the "shift" block in the COPY macro set the pointer for the next copy block to the wrong value. In this case, the link-layer header would be overwritten by the network-layer header. This case is difficult or impossible to exercise in the current driver without changing the value of the hw.genet.tx_hdr_min sysctl. Correct the pointer. While here, remove a line in the macro that was marked "unneeded", which was actually wrong. PR: 263824 Submitted by: jiahali@blackberry.com MFC after: 2 weeks sys/arm64/broadcom/genet/if_genet.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --=20 You are receiving this mail because: You are on the CC list for the bug.=