michaelh/zephyr
1
0
Fork 0
Code Releases Activity

net: ethernet: Check that header is valid

Browse source 
Saw this crash with heavily loaded system in mimxrt1050_evk:

<err> os: ***** MPU FAULT *****
<err> os:   Data Access Violation
<err> os:   MMFAR Address: 0xc
<err> os: r0/a1:  0x80000ab0  r1/a2:  0x800f6a60  r2/a3:  0x00000000
<err> os: r3/a4:  0x800f72a0 r12/ip:  0x00000000 r14/lr:  0x6000eb43
<err> os:  xpsr:  0x41000000
<err> os: Faulting instruction address (r15/pc): 0x6000dc82
<err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
<err> os: Current thread: 0x80001a18 (rx_workq)
<err> os: Halting system

Where the fault at 0x6000dc82 points to ethernet_recv()

	uint16_t type = ntohs(hdr->type);
6000dc82:	89ab      	ldrh	r3, [r5, #12]

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
This commit is contained in:
Jukka Rissanen 2020-09-22 18:02:04 +03:00 • committed by Jukka Rissanen
commit be072b1255
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
subsys/net/l2/ethernet/ethernet.c
View file

@ -174,10 +174,16 @@ static enum net_verdict ethernet_recv(struct net_if *iface,
struct ethernet_context *ctx = net_if_l2_data(iface);
struct net_eth_hdr *hdr = NET_ETH_HDR(pkt);
uint8_t hdr_len = sizeof(struct net_eth_hdr);
uint16_t type = ntohs(hdr->type);
uint16_t type;
struct net_linkaddr *lladdr;
sa_family_t family;
if (hdr == NULL) {
goto drop;
}
type = ntohs(hdr->type);
if (net_eth_is_vlan_enabled(ctx, iface) &&
type == NET_ETH_PTYPE_VLAN &&
!eth_is_vlan_tag_stripped(iface)) {