Commit dd61df65 authored by Heiner Kallweit's avatar Heiner Kallweit Committed by Liu Jian
Browse files

r8169: use READ_ONCE in rtl_tx_slots_avail 

mainline inclusion
from mainline-v5.11-rc1
commit 95f3c545
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SF4
CVE: CVE-2024-38586

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95f3c5458dfa5856bb110e31d156e00d894d0134



---------------------------

tp->dirty_tx and tp->cur_tx may be changed by a racing rtl_tx() or
rtl8169_start_xmit(). Use READ_ONCE() to annotate the races and ensure
that the compiler doesn't use cached values.

Signed-off-by: default avatarHeiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/5676fee3-f6b4-84f2-eba5-c64949a371ad@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 1645ad1b

drivers/net/ethernet/realtek/r8169_main.c

+2 −1
Original line number Diff line number Diff line
@@ -4247,7 +4247,8 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp, 
static bool rtl_tx_slots_avail(struct rtl8169_private *tp,

			       unsigned int nr_frags)

{

	unsigned int slots_avail = tp->dirty_tx + NUM_TX_DESC - tp->cur_tx;

	unsigned int slots_avail = READ_ONCE(tp->dirty_tx) + NUM_TX_DESC

					- READ_ONCE(tp->cur_tx);



	/* A skbuff with nr_frags needs nr_frags+1 entries in the tx queue */

	return slots_avail > nr_frags;