Skip to content

Commit aceebde

Browse files
pvts-matbmastbergen
authored andcommitted
igb: set max size RX buffer when store bad packet is enabled
jira VULN-6698 cve CVE-2023-45871 commit-author Radoslaw Tyl <radoslawx.tyl@intel.com> commit bb5ed01 Increase the RX buffer size to 3K when the SBP bit is on. The size of the RX buffer determines the number of pages allocated which may not be sufficient for receive frames larger than the set MTU size. Cc: stable@vger.kernel.org Fixes: 89eaefb ("igb: Support RX-ALL feature flag.") Reported-by: Manfred Rudigier <manfred.rudigier@omicronenergy.com> Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com> Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit bb5ed01) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
1 parent c718661 commit aceebde

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

drivers/net/ethernet/intel/igb/igb_main.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4731,6 +4731,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter,
47314731
static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
47324732
struct igb_ring *rx_ring)
47334733
{
4734+
#if (PAGE_SIZE < 8192)
4735+
struct e1000_hw *hw = &adapter->hw;
4736+
#endif
4737+
47344738
/* set build_skb and buffer size flags */
47354739
clear_ring_build_skb_enabled(rx_ring);
47364740
clear_ring_uses_large_buffer(rx_ring);
@@ -4741,10 +4745,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
47414745
set_ring_build_skb_enabled(rx_ring);
47424746

47434747
#if (PAGE_SIZE < 8192)
4744-
if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB)
4745-
return;
4746-
4747-
set_ring_uses_large_buffer(rx_ring);
4748+
if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB ||
4749+
rd32(E1000_RCTL) & E1000_RCTL_SBP)
4750+
set_ring_uses_large_buffer(rx_ring);
47484751
#endif
47494752
}
47504753

0 commit comments

Comments
 (0)