When an skb arrives at the driver and the header length exceeds the u8 hdr_len, tucss and tucso fields in e1000_context_desc, wrapped values are sent to the card and it hangs. This was reproduced on an I218-V with an unprivileged Python script. Fix it by disabling GSO and checksum offload when the header length (and checksum offset) would exceed the field widths. Compensate for a software-inserted VLAN tag. Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Matt Vollrath --- drivers/net/ethernet/intel/e1000e/netdev.c | 23 +++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c index 6f85dab5c55c5..11714032793ef 100644 --- a/drivers/net/ethernet/intel/e1000e/netdev.c +++ b/drivers/net/ethernet/intel/e1000e/netdev.c @@ -7355,6 +7355,27 @@ static int e1000_set_features(struct net_device *netdev, return 1; } +static netdev_features_t e1000_features_check(struct sk_buff *skb, + struct net_device *netdev, + netdev_features_t features) +{ + unsigned int hdr_len = 0; + + if (skb_is_gso_tcp(skb)) + hdr_len = skb_tcp_all_headers(skb); + else if (skb->ip_summed == CHECKSUM_PARTIAL) + hdr_len = skb_checksum_start_offset(skb) + skb->csum_offset; + + if (skb_vlan_tag_present(skb) && + !vlan_hw_offload_capable(features, skb->vlan_proto)) + hdr_len += VLAN_HLEN; + + if (hdr_len > U8_MAX) + features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK); + + return features; +} + static const struct net_device_ops e1000e_netdev_ops = { .ndo_open = e1000e_open, .ndo_stop = e1000e_close, @@ -7374,7 +7395,7 @@ static const struct net_device_ops e1000e_netdev_ops = { #endif .ndo_set_features = e1000_set_features, .ndo_fix_features = e1000_fix_features, - .ndo_features_check = passthru_features_check, + .ndo_features_check = e1000_features_check, .ndo_hwtstamp_get = e1000e_hwtstamp_get, .ndo_hwtstamp_set = e1000e_hwtstamp_set, }; base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5 -- 2.43.0