max/embassy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

stm32: resolve eth/v2 security bug

Browse Source 
fixes #2129
This commit is contained in:
xoviat 2023-11-07 15:39:06 -06:00
parent 584fc358fd
commit 553f0158c0
1 changed files with 10 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
embassy-stm32/src/eth/v2/descriptors.rs
View File

@ -119,13 +119,11 @@ impl<'a> TDesRing<'a> {
// "Preceding reads and writes cannot be moved past subsequent writes." // "Preceding reads and writes cannot be moved past subsequent writes."
fence(Ordering::Release); fence(Ordering::Release);
self.index = self.index + 1;
if self.index == self.descriptors.len() {
self.index = 0;
}
// signal DMA it can try again. // signal DMA it can try again.
ETH.ethernet_dma().dmactx_dtpr().write(|w| w.0 = 0) // See issue #2129
ETH.ethernet_dma().dmactx_dtpr().write(|w| w.0 = &td as *const _ as u32);
self.index = (self.index + 1) % self.descriptors.len();
} }
} }
@ -237,21 +235,19 @@ impl<'a> RDesRing<'a> {
/// Pop the packet previously returned by `available`. /// Pop the packet previously returned by `available`.
pub(crate) fn pop_packet(&mut self) { pub(crate) fn pop_packet(&mut self) {
let descriptor = &mut self.descriptors[self.index]; let rd = &mut self.descriptors[self.index];
assert!(descriptor.available()); assert!(rd.available());
self.descriptors[self.index].set_ready(self.buffers[self.index].0.as_mut_ptr()); rd.set_ready(self.buffers[self.index].0.as_mut_ptr());
// "Preceding reads and writes cannot be moved past subsequent writes." // "Preceding reads and writes cannot be moved past subsequent writes."
fence(Ordering::Release); fence(Ordering::Release);
// signal DMA it can try again. // signal DMA it can try again.
ETH.ethernet_dma().dmacrx_dtpr().write(|w| w.0 = 0); // See issue #2129
ETH.ethernet_dma().dmacrx_dtpr().write(|w| w.0 = &rd as *const _ as u32);
// Increment index. // Increment index.
self.index += 1; self.index = (self.index + 1) % self.descriptors.len();
if self.index == self.descriptors.len() {
self.index = 0
}
} }
} }