Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1302683

[PATCH 3.16.y-ckt 030/126] packet: only allow extra vlan len on ethernet devices

From Luis Henriques <luis.henriques@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.16.y-ckt 030/126] packet: only allow extra vlan len on ethernet devices
Date 2016-01-06 12:20 +0100
Message-ID <qNUif-nA-57@gated-at.bofh.it> (permalink)
References <qNTFw-8jf-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.16.7-ckt22 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>

commit 3c70c132488794e2489ab045559b0ce0afcf17de upstream.

Packet sockets can be used by various net devices and are not
really restricted to ARPHRD_ETHER device types. However, when
currently checking for the extra 4 bytes that can be transmitted
in VLAN case, our assumption is that we generally probe on
ARPHRD_ETHER devices. Therefore, before looking into Ethernet
header, check the device type first.

This also fixes the issue where non-ARPHRD_ETHER devices could
have no dev->hard_header_len in TX_RING SOCK_RAW case, and thus
the check would test unfilled linear part of the skb (instead
of non-linear).

Fixes: 57f89bfa2140 ("network: Allow af_packet to transmit +4 bytes for VLAN packets.")
Fixes: 52f1454f629f ("packet: allow to transmit +4 byte in TX_RING slot for VLAN case")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/packet/af_packet.c | 60 +++++++++++++++++++++-----------------------------
 1 file changed, 25 insertions(+), 35 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index fc94622f755c..92bb65796fb4 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1517,6 +1517,20 @@ static void fanout_release(struct sock *sk)
 	mutex_unlock(&fanout_mutex);
 }
 
+static bool packet_extra_vlan_len_allowed(const struct net_device *dev,
+					  struct sk_buff *skb)
+{
+	/* Earlier code assumed this would be a VLAN pkt, double-check
+	 * this now that we have the actual packet in hand. We can only
+	 * do this check on Ethernet devices.
+	 */
+	if (unlikely(dev->type != ARPHRD_ETHER))
+		return false;
+
+	skb_reset_mac_header(skb);
+	return likely(eth_hdr(skb)->h_proto == htons(ETH_P_8021Q));
+}
+
 static const struct proto_ops packet_ops;
 
 static const struct proto_ops packet_ops_spkt;
@@ -1678,18 +1692,10 @@ retry:
 		goto retry;
 	}
 
-	if (len > (dev->mtu + dev->hard_header_len + extra_len)) {
-		/* Earlier code assumed this would be a VLAN pkt,
-		 * double-check this now that we have the actual
-		 * packet in hand.
-		 */
-		struct ethhdr *ehdr;
-		skb_reset_mac_header(skb);
-		ehdr = eth_hdr(skb);
-		if (ehdr->h_proto != htons(ETH_P_8021Q)) {
-			err = -EMSGSIZE;
-			goto out_unlock;
-		}
+	if (len > (dev->mtu + dev->hard_header_len + extra_len) &&
+	    !packet_extra_vlan_len_allowed(dev, skb)) {
+		err = -EMSGSIZE;
+		goto out_unlock;
 	}
 
 	skb->protocol = proto;
@@ -2286,18 +2292,10 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 		tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto,
 					  addr, hlen);
 		if (likely(tp_len >= 0) &&
-		    tp_len > dev->mtu + dev->hard_header_len) {
-			struct ethhdr *ehdr;
-			/* Earlier code assumed this would be a VLAN pkt,
-			 * double-check this now that we have the actual
-			 * packet in hand.
-			 */
+		    tp_len > dev->mtu + dev->hard_header_len &&
+		    !packet_extra_vlan_len_allowed(dev, skb))
+			tp_len = -EMSGSIZE;
 
-			skb_reset_mac_header(skb);
-			ehdr = eth_hdr(skb);
-			if (ehdr->h_proto != htons(ETH_P_8021Q))
-				tp_len = -EMSGSIZE;
-		}
 		if (unlikely(tp_len < 0)) {
 			if (po->tp_loss) {
 				__packet_set_status(po, ph,
@@ -2509,18 +2507,10 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 
 	sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);
 
-	if (!gso_type && (len > dev->mtu + reserve + extra_len)) {
-		/* Earlier code assumed this would be a VLAN pkt,
-		 * double-check this now that we have the actual
-		 * packet in hand.
-		 */
-		struct ethhdr *ehdr;
-		skb_reset_mac_header(skb);
-		ehdr = eth_hdr(skb);
-		if (ehdr->h_proto != htons(ETH_P_8021Q)) {
-			err = -EMSGSIZE;
-			goto out_free;
-		}
+	if (!gso_type && (len > dev->mtu + reserve + extra_len) &&
+	    !packet_extra_vlan_len_allowed(dev, skb)) {
+		err = -EMSGSIZE;
+		goto out_free;
 	}
 
 	skb->protocol = proto;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.16.y-ckt stable] Linux 3.16.7-ckt22 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 009/126] USB: serial: option: add support for Novatel MiFi USB620L Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 015/126] usb: dwc3: gadget: let us set lower max_speed Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 007/126] drm/i915: quirk backlight present on Macbook 4, 1 Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 032/126] sctp: translate host order to network order when setting a hmacid Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 001/126] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 038/126] unix: avoid use-after-free in ep_remove_wait_queue Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 034/126] usb: musb: core: fix order of arguments to ulpi write callback Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 027/126] mmc: remove bondage between REQ_META and reliable write Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 006/126] iio: adc: xilinx: Fix VREFN scale Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 035/126] FS-Cache: Add missing initialization of ret in cachefiles_write_page() Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 013/126] USB: qcserial: Fix support for HP lt4112 LTE/HSPA+ Gobi 4G Modem Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 004/126] iio:ad7793: Fix ad7785 product ID Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 023/126] fat: fix fake_offset handling on error path Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 019/126] x86/cpu: Fix SMAP check in PVOPS environments Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 003/126] iio: ad5064: Fix ad5629/ad5669 shift Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 010/126] USB: ti_usb_3410_5052: Add Honeywell HGI80 ID Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 016/126] usb: chipidea: debug: disable usb irq while role switch Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 029/126] packet: do skb_probe_transport_header when we actually have data Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 030/126] packet: only allow extra vlan len on ethernet devices Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 018/126] xhci: Fix a race in usb2 LPM resume, blocking U3 for usb2 devices Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 005/126] x86/fpu: Fix 32-bit signal frame handling Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 011/126] drm/i915: get runtime PM reference around GEM set_caching IOCTL Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 020/126] arm64: restore bogomips information in /proc/cpuinfo Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:20 +0100
  [PATCH 3.16.y-ckt 002/126] iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success Luis Henriques <luis.henriques@canonical.com> - 2016-01-06 12:30 +0100

csiph-web