fe_poll_rx() takes the packet length directly from the RX descriptor and
passes it to skb_put() without checking that it fits in the allocated
buffer. A malformed or stale descriptor can therefore extend the skb
beyond its tailroom and corrupt memory.
Reject lengths larger than skb_tailroom(), account the packet in
rx_length_errors and rx_dropped, free the affected skb, and continue by
installing the replacement descriptor.
Signed-off-by: Nickolay Savchenko <n.savchenko@axioma.lv>
Link: https://github.com/openwrt/openwrt/pull/24268
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
fe_txd_unmap() uses dma_len0 and dma_len1 to decide whether each TX
mapping must be passed to dma_unmap_page(). After unmapping, however,
the code passed the dma_addr0 and dma_addr1 field identifiers to
dma_unmap_len_set().
This leaves the actual length fields unchanged. A reused descriptor
slot can therefore retain a non-zero length and attempt to unmap an old
DMA mapping again.
Clear dma_len0 and dma_len1 after the mappings have been released.
Signed-off-by: Nickolay Savchenko <n.savchenko@axioma.lv>
Link: https://github.com/openwrt/openwrt/pull/24268
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
