Skip to content

Commit 64528c2

Browse files
pvts-matPlaidCat
authored andcommitted
igb: set max size RX buffer when store bad packet is enabled
jira VULN-8852 cve CVE-2023-45871 commit-author Radoslaw Tyl <radoslawx.tyl@intel.com> commit bb5ed01 Increase the RX buffer size to 3K when the SBP bit is on. The size of the RX buffer determines the number of pages allocated which may not be sufficient for receive frames larger than the set MTU size. Cc: stable@vger.kernel.org Fixes: 89eaefb ("igb: Support RX-ALL feature flag.") Reported-by: Manfred Rudigier <manfred.rudigier@omicronenergy.com> Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com> Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit bb5ed01) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl> Signed-off-by: Jonathan Maple <jmaple@ciq.com>
1 parent cb9e256 commit 64528c2

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

drivers/net/ethernet/intel/igb/igb_main.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4730,6 +4730,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter,
47304730
static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
47314731
struct igb_ring *rx_ring)
47324732
{
4733+
#if (PAGE_SIZE < 8192)
4734+
struct e1000_hw *hw = &adapter->hw;
4735+
#endif
4736+
47334737
/* set build_skb and buffer size flags */
47344738
clear_ring_build_skb_enabled(rx_ring);
47354739
clear_ring_uses_large_buffer(rx_ring);
@@ -4740,10 +4744,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
47404744
set_ring_build_skb_enabled(rx_ring);
47414745

47424746
#if (PAGE_SIZE < 8192)
4743-
if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB)
4744-
return;
4745-
4746-
set_ring_uses_large_buffer(rx_ring);
4747+
if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB ||
4748+
rd32(E1000_RCTL) & E1000_RCTL_SBP)
4749+
set_ring_uses_large_buffer(rx_ring);
47474750
#endif
47484751
}
47494752

0 commit comments

Comments
 (0)