Description
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the hardware packet offset mvpp2 programs the RX queue packet offset, so hardware writes received data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the unused headroom and misses the same number of bytes at the packet tail. On non-coherent DMA systems this can leave the CPU reading stale cache contents for the end of the received frame. Use dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range offset so the sync covers the Marvell header and packet data actually written by hardware.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e1921168bbd4810de4197446e52f652cd0dd9541 to < 60412bdd1b2576659eac23a23d2d9ff96228a643affectede1921168bbd4810de4197446e52f652cd0dd9541 to < 19f8bc139e9b149d1e5bf75ae761d1bb8dd3e7d8affectede1921168bbd4810de4197446e52f652cd0dd9541 to < a3ad9b5767c89531fc7dae951b51b0933dcf7051affectede1921168bbd4810de4197446e52f652cd0dd9541 to < bede0f481b9137d73d1cf64309cbe4b94818a5d6affectede1921168bbd4810de4197446e52f652cd0dd9541 to < 23548007b3c66d628fc7d6b80d1e23be04ea10d9affectede1921168bbd4810de4197446e52f652cd0dd9541 to < a13199fa224e9f776f4005d5037df03aa9ea8f37affectede1921168bbd4810de4197446e52f652cd0dd9541 to < e302206ad84a407a7e5f3f6fe767ff5efaace689affectede1921168bbd4810de4197446e52f652cd0dd9541 to < 180235600934bef6add3be637c296d6cf3272e67affected
Linux Linux
Default version status: affected
5.5affected0 to < 5.5unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.94 to ≤ 6.12.*unaffected6.18.36 to ≤ 6.18.*unaffected7.0.13 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/60412bdd1b2576659eac23a23d2d9ff96228a643 ↗
- https://git.kernel.org/stable/c/19f8bc139e9b149d1e5bf75ae761d1bb8dd3e7d8 ↗
- https://git.kernel.org/stable/c/a3ad9b5767c89531fc7dae951b51b0933dcf7051 ↗
- https://git.kernel.org/stable/c/bede0f481b9137d73d1cf64309cbe4b94818a5d6 ↗
- https://git.kernel.org/stable/c/23548007b3c66d628fc7d6b80d1e23be04ea10d9 ↗
- https://git.kernel.org/stable/c/a13199fa224e9f776f4005d5037df03aa9ea8f37 ↗
- https://git.kernel.org/stable/c/e302206ad84a407a7e5f3f6fe767ff5efaace689 ↗
- https://git.kernel.org/stable/c/180235600934bef6add3be637c296d6cf3272e67 ↗