From 553f0158c0a8abaa293ada3b3f214194418a767e Mon Sep 17 00:00:00 2001
From: xoviat <xoviat@users.noreply.github.com>
Date: Tue, 7 Nov 2023 15:39:06 -0600
Subject: [PATCH] stm32: resolve eth/v2 security bug fixes #2129
---
embassy-stm32/src/eth/v2/descriptors.rs | 24 ++++++++++--------------
1 file changed, 10 insertions(+), 14 deletions(-)
diff --git a/embassy-stm32/src/eth/v2/descriptors.rs b/embassy-stm32/src/eth/v2/descriptors.rs
index e9799adf1..01ea8e574 100644
--- a/embassy-stm32/src/eth/v2/descriptors.rs
+++ b/embassy-stm32/src/eth/v2/descriptors.rs
@@ -119,13 +119,11 @@ impl<'a> TDesRing<'a> {
// "Preceding reads and writes cannot be moved past subsequent writes."
fence(Ordering::Release);
- self.index = self.index + 1;
- if self.index == self.descriptors.len() {
- self.index = 0;
- }
-
// signal DMA it can try again.
- ETH.ethernet_dma().dmactx_dtpr().write(|w| w.0 = 0)
+ // See issue #2129
+ ETH.ethernet_dma().dmactx_dtpr().write(|w| w.0 = &td as *const _ as u32);
+
+ self.index = (self.index + 1) % self.descriptors.len();
}
}
@@ -237,21 +235,19 @@ impl<'a> RDesRing<'a> {
/// Pop the packet previously returned by `available`.
pub(crate) fn pop_packet(&mut self) {
- let descriptor = &mut self.descriptors[self.index];
- assert!(descriptor.available());
+ let rd = &mut self.descriptors[self.index];
+ assert!(rd.available());
- self.descriptors[self.index].set_ready(self.buffers[self.index].0.as_mut_ptr());
+ rd.set_ready(self.buffers[self.index].0.as_mut_ptr());
// "Preceding reads and writes cannot be moved past subsequent writes."
fence(Ordering::Release);
// signal DMA it can try again.
- ETH.ethernet_dma().dmacrx_dtpr().write(|w| w.0 = 0);
+ // See issue #2129
+ ETH.ethernet_dma().dmacrx_dtpr().write(|w| w.0 = &rd as *const _ as u32);
// Increment index.
- self.index += 1;
- if self.index == self.descriptors.len() {
- self.index = 0
- }
+ self.index = (self.index + 1) % self.descriptors.len();
}
}