Linux Kernel Cortina Ethernet Driver Fragment Counter Carry-Over Vulnerability

A vulnerability exists in the Linux kernel's handling of Ethernet packet assembly in the Cortina Gemini driver. The issue arises in the gmac_rx() NAPI poll function, which processes packets from a ring buffer. If the buffer is completely emptied during a polling cycle, the function exits before the packet is fully assembled in the socket buffer (SKB). However, the fragment counter is prematurely reset to zero on the next invocation. This vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability can lead to improper packet handling, potentially causing fragmentation issues in network communication.

Reproduction

The vulnerability can be reproduced by using the Cortina Ethernet driver with the Gemini gigabit Ethernet hardware. During normal operation, if the NAPI polling cycle empties the ring buffer completely, the gmac_rx() function will exit before the packet is fully assembled in the SKB. This can be observed by monitoring the fragment counter, which will be reset to zero prematurely, disrupting the proper assembly of packets.

Remediation

The vulnerability has been addressed by modifying the driver to make the RX fragment counter a part of the port structure, allowing it to carry over between function invocations. This change ensures that the fragment counter is only reset at appropriate times, such as after calling napi_gro_frags(), on error, or when stopping the port.