gemini RxFrag Corruption

Vulnerability analysis

The root cause is that the local variable frag_nr in gmac_rx() is initialized to 0 on every invocation of the NAPI poll function. When the RX ring buffer is exhausted mid-packet (i.e., a multi-fragment packet spans two poll cycles), the fragment counter is reset, causing subsequent fragments to be placed at wrong indices in the SKB fragment array. This constitutes memory buffer corruption: subsequent calls to skb_add_rx_frag() overwrite earlier fragment entries and corrupt SKB length and page-tracking state. The fix moves frag_nr into the persistent port struct as rx_frag_nr, loading it at the start of gmac_rx() and writing it back at the end, so state is correctly carried across poll cycles. The counter is only reset to zero after napi_gro_frags() (packet complete), napi_free_frags() (error/drop), or gmac_stop() (port shutdown). The attack surface is systems using the Cortina/Gemini Ethernet hardware (StorLink SL3512/SL3516 SoCs); triggering the bug requires receiving network traffic that results in multi-fragment packets spanning poll boundaries, which can be induced by a remote sender. No privileges are required on the target system.