Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1733933
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.12 20/52] packet: Dont write vnet header beyond end of buffer |
| Date | 2017-09-18 11:50 +0200 |
| Message-ID | <ur0QG-4nB-7@gated-at.bofh.it> (permalink) |
| References | <ur0nE-4ck-23@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <bpoirier@suse.com>
[ Upstream commit edbd58be15a957f6a760c4a514cd475217eb97fd ]
... which may happen with certain values of tp_reserve and maclen.
Fixes: 58d19b19cd99 ("packet: vnet_hdr support for tpacket_rcv")
Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2192,6 +2192,7 @@ static int tpacket_rcv(struct sk_buff *s
struct timespec ts;
__u32 ts_status;
bool is_drop_n_account = false;
+ bool do_vnet = false;
/* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT.
* We may add members to them until current aligned size without forcing
@@ -2242,8 +2243,10 @@ static int tpacket_rcv(struct sk_buff *s
netoff = TPACKET_ALIGN(po->tp_hdrlen +
(maclen < 16 ? 16 : maclen)) +
po->tp_reserve;
- if (po->has_vnet_hdr)
+ if (po->has_vnet_hdr) {
netoff += sizeof(struct virtio_net_hdr);
+ do_vnet = true;
+ }
macoff = netoff - maclen;
}
if (po->tp_version <= TPACKET_V2) {
@@ -2260,8 +2263,10 @@ static int tpacket_rcv(struct sk_buff *s
skb_set_owner_r(copy_skb, sk);
}
snaplen = po->rx_ring.frame_size - macoff;
- if ((int)snaplen < 0)
+ if ((int)snaplen < 0) {
snaplen = 0;
+ do_vnet = false;
+ }
}
} else if (unlikely(macoff + snaplen >
GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len)) {
@@ -2274,6 +2279,7 @@ static int tpacket_rcv(struct sk_buff *s
if (unlikely((int)snaplen < 0)) {
snaplen = 0;
macoff = GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len;
+ do_vnet = false;
}
}
spin_lock(&sk->sk_receive_queue.lock);
@@ -2299,7 +2305,7 @@ static int tpacket_rcv(struct sk_buff *s
}
spin_unlock(&sk->sk_receive_queue.lock);
- if (po->has_vnet_hdr) {
+ if (do_vnet) {
if (virtio_net_hdr_from_skb(skb, h.raw + macoff -
sizeof(struct virtio_net_hdr),
vio_le(), true)) {
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.12 00/52] 4.12.14-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
[PATCH 4.12 25/52] net/mlx5: Fix arm SRQ command for ISSI version 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
[PATCH 4.12 45/52] f2fs: check hot_data for roll-forward recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:40 +0200
[PATCH 4.12 49/52] fuse: allow server to run in different pid_ns Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:40 +0200
[PATCH 4.12 52/52] md/raid5: release/flush io in raid5_do_work() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:40 +0200
[PATCH 4.12 06/52] bpf: fix map value attribute for hash of maps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 39/52] vhost_net: correctly check tx avail during rx busy polling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 20/52] packet: Dont write vnet header beyond end of buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 31/52] net/mlx5e: Fix CQ moderation mode not set properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 21/52] kcm: do not attach PF_KCM sockets to avoid deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 17/52] cxgb4: Fix stack out-of-bounds read due to wrong size to t4_record_mbox() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 38/52] gianfar: Fix Tx flow control deactivation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 12/52] net: bcmgenet: Be drop monitor friendly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 23/52] net/mlx5e: Check for qos capability in dcbnl_initialize Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 48/52] x86/switch_to/64: Rewrite FS/GS switching yet again to fix AMD CPUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 41/52] ipv6: fix memory leak with multiple tables during netns destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 29/52] net/mlx5: E-Switch, Unload the representors in the correct order Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 33/52] net: fec: Allow reception of frames bigger than 1522 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 16/52] net: mvpp2: fix the mac address used when using PPv2.2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 09/52] qlge: avoid memcpy buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 13/52] net: systemport: Free DMA coherent descriptors on errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 40/52] ip6_gre: update mtu properly in ip6gre_err Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 43/52] sctp: fix missing wake ups in some situations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 27/52] net/mlx5e: Dont override user RSS upon set channels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 19/52] ipv6: do not set sk_destruct in IPV6_ADDRFORM sockopt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 37/52] Revert "net: fix percpu memory leaks" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 15/52] udp6: set rx_dst_cookie on rx_dst updates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 26/52] net/mlx5e: Fix dangling page pointer on DMA mapping error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 28/52] net/mlx5e: Properly resolve TC offloaded ipv6 vxlan tunnel source address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 46/52] x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
[PATCH 4.12 02/52] ipv6: add rcu grace period before freeing fib6_node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
[PATCH 4.12 03/52] ipv6: fix sparse warning on rt6i_node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
[PATCH 4.12 10/52] tipc: Fix tipc_sk_reinit handling of -EAGAIN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
Re: [PATCH 4.12 00/52] 4.12.14-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2017-09-18 16:30 +0200
Re: [PATCH 4.12 00/52] 4.12.14-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-19 08:40 +0200
Re: [PATCH 4.12 00/52] 4.12.14-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2017-09-20 14:20 +0200
Re: [PATCH 4.12 00/52] 4.12.14-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-18 21:30 +0200
Re: [PATCH 4.12 00/52] 4.12.14-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-18 22:20 +0200
csiph-web