From nobody Mon May 23 11:59:48 2022 X-Original-To: net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id F31161B4EB1B for ; Mon, 23 May 2022 11:59:48 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4L6G9047hdz3nkZ for ; Mon, 23 May 2022 11:59:48 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 6EA6A70D2 for ; Mon, 23 May 2022 11:59:48 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 24NBxm0a039367 for ; Mon, 23 May 2022 11:59:48 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from bugzilla@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 24NBxmaf039366 for net@FreeBSD.org; Mon, 23 May 2022 11:59:48 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: bugzilla set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 263824] genet(4): Driver interface may overwrite memory in a consecutive memory copy operations when parsing TX packet Date: Mon, 23 May 2022 11:59:48 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: bin X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: needs-qa, security X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: commit-hook@FreeBSD.org X-Bugzilla-Status: In Progress X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: karels@freebsd.org X-Bugzilla-Flags: maintainer-feedback? mfc-stable12- X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@freebsd.org MIME-Version: 1.0 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1653307188; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=PLyhYSPMwTZ1LtyHgFWQyP0BEU0FJIa6sltU0LHINFg=; b=dX2orGQ9MSeTtX5vZQxfy4n5D8KD8LvtwUYIcCO+dCb/pz4FYThH9bLy5VaqJG1fTQnN8p mKajeIGz02B3B5YtO5DtczdQ0PWCyQu9do+HA8YqGx7UJZ2yDBUwKjRJdwFK1NXOIyEfMM bus+hGk8uAXwVx+UV5lbaPHnDJYus176sqbYgfS1U3Rux+PTY/WICWxvOaWpA/XFAaml45 ncpMfapINfyw9imYMSuOlwSIfbsmUbpMwO4yzbHnSsCkLu/vppOzfpB10UaFkxuh+EoVMa NmtfPUQm7Bmbdc+05/5d5WszRgGxK14VJ1KZsJJHA2BQfhuFYUjtiNW/MWucdA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1653307188; a=rsa-sha256; cv=none; b=XkwwkS6WldIcNnsQwKvZ3xAmP/Jpg/H2ucuRbB46nwiuwX+TCOeyYUG4MsQOyDF7lF7V5W /J8p7PHKqxv/YNtXKzqBqEoW8iNdF8vyF3AhVN8IvMMvlvrgNWJOoqwbZk1CaBgsNpgYbp ZMuSkTpnK+Vn7wabJ9emHHmX6RUqmq5gq0ODWydAy8kiIqYjRzDLMLD/GOvQ4JTDbK1E2N zFVUhnHDSWMr437A7VVPLCkCi/JvA+5I01wKMPR0JoXG4bwoAiWxgP7bGLijZYPub3WiAe z/WzGOIhF2SNrYWnAzAuAuKVZsDJEwO6nKLnZ5DpQFRpqAriQmlPBYalnjfWVg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D263824 --- Comment #7 from commit-hook@FreeBSD.org --- A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3D7e6e22aab6b993e42328bafe0f64ee14a= 2b7c43c commit 7e6e22aab6b993e42328bafe0f64ee14a2b7c43c Author: Mike Karels AuthorDate: 2022-05-09 12:19:52 +0000 Commit: Mike Karels CommitDate: 2022-05-23 11:53:01 +0000 genet: fix output packet corruption in uncommon case The code for the "shift" block in the COPY macro set the pointer for the next copy block to the wrong value. In this case, the link-layer header would be overwritten by the network-layer header. This case is difficult or impossible to exercise in the current driver without changing the value of the hw.genet.tx_hdr_min sysctl. Correct the pointer. While here, remove a line in the macro that was marked "unneeded", which was actually wrong. PR: 263824 Submitted by: jiahali@blackberry.com (cherry picked from commit 1de9aa4d4f7938f36e6485dad817908a6e45bb32) sys/arm64/broadcom/genet/if_genet.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --=20 You are receiving this mail because: You are on the CC list for the bug.=