Messages in this thread | | | Date | Tue, 15 Nov 2016 02:10:44 +0100 | From | Francois Romieu <> | Subject | Re: [PATCH net 2/2] r8152: rx descriptor check |
| |
Hayes Wang <hayeswang@realtek.com> : > Francois Romieu [mailto:romieu@fr.zoreil.com] > > Sent: Friday, November 11, 2016 8:13 PM > [...] > > Invalid packet size corrupted receive descriptors in Realtek's device > > reminds of CVE-2009-4537. > > Do you mean that the driver would get a packet exceed the size > which is set to RxMaxSize ?
If it was possible to get it wrong once, it should be possible to get it wrong twice, especially if some part of the hardware design is recycled. I don't mean anything else.
I won't speculate about some cache consistency issue or some badly aborted dma transaction to explain the memory corruption.
-- Ueimor
| |