From 553f0158c0a8abaa293ada3b3f214194418a767e Mon Sep 17 00:00:00 2001 From: xoviat Date: Tue, 7 Nov 2023 15:39:06 -0600 Subject: [PATCH] stm32: resolve eth/v2 security bug fixes #2129 --- embassy-stm32/src/eth/v2/descriptors.rs | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/embassy-stm32/src/eth/v2/descriptors.rs b/embassy-stm32/src/eth/v2/descriptors.rs index e9799adf..01ea8e57 100644 --- a/embassy-stm32/src/eth/v2/descriptors.rs +++ b/embassy-stm32/src/eth/v2/descriptors.rs @@ -119,13 +119,11 @@ impl<'a> TDesRing<'a> { // "Preceding reads and writes cannot be moved past subsequent writes." fence(Ordering::Release); - self.index = self.index + 1; - if self.index == self.descriptors.len() { - self.index = 0; - } - // signal DMA it can try again. - ETH.ethernet_dma().dmactx_dtpr().write(|w| w.0 = 0) + // See issue #2129 + ETH.ethernet_dma().dmactx_dtpr().write(|w| w.0 = &td as *const _ as u32); + + self.index = (self.index + 1) % self.descriptors.len(); } } @@ -237,21 +235,19 @@ impl<'a> RDesRing<'a> { /// Pop the packet previously returned by `available`. pub(crate) fn pop_packet(&mut self) { - let descriptor = &mut self.descriptors[self.index]; - assert!(descriptor.available()); + let rd = &mut self.descriptors[self.index]; + assert!(rd.available()); - self.descriptors[self.index].set_ready(self.buffers[self.index].0.as_mut_ptr()); + rd.set_ready(self.buffers[self.index].0.as_mut_ptr()); // "Preceding reads and writes cannot be moved past subsequent writes." fence(Ordering::Release); // signal DMA it can try again. - ETH.ethernet_dma().dmacrx_dtpr().write(|w| w.0 = 0); + // See issue #2129 + ETH.ethernet_dma().dmacrx_dtpr().write(|w| w.0 = &rd as *const _ as u32); // Increment index. - self.index += 1; - if self.index == self.descriptors.len() { - self.index = 0 - } + self.index = (self.index + 1) % self.descriptors.len(); } }