bnxt driver: bd_cnt field missing mask causing TX timeout

Kernel Vulnerability Summary: Missing Mask for Field in bxtx Driver Vulnerability Overview Vulnerability Type: Missing field mask (Mask the bd_cnt field in the TX BD properly) Root Cause: The field is used to specify the number of BDs that can fit into each TX BD. This field is 5 bits long, supporting a maximum value of 31 (i.e., 32 BDs). If the value exceeds 32 and no masking is applied, it results in TX BD corruption, which in turn triggers a TX timeout. Fix: 1. Introduce a new configuration option , allowing users to adjust the upper limit of . 2. Apply masking to in the code to ensure its value does not exceed 32. 3. Apply masking to to ensure its value does not exceed 32. Scope of Impact Affected Driver: driver (Broadcom network interface card driver) Affected Files: - - - POC Code / Exploit Code 1. Fix code in `` bnxt.c bd_cnt` field if ((skb->len > CHECKSUM_PARTIAL) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD TYPE LONG TX BD) (skb->len > TX BD T

Goal Reached Thanks to every supporter — we hit 100%!

bnxt driver: bd_cnt field missing mask causing TX timeout

More from this source