linux-stable.git/drivers/firewire/net.c, branch v3.2.84

firewire: net: guard against rx buffer overflows

2016-11-20T01:01:43+00:00

commit 667121ace9dbafb368618dbabcf07901c962ddac upstream.

The IP-over-1394 driver firewire-net lacked input validation when
handling incoming fragmented datagrams.  A maliciously formed fragment
with a respectively large datagram_offset would cause a memcpy past the
datagram buffer.

So, drop any packets carrying a fragment with offset + length larger
than datagram_size.

In addition, ensure that
  - GASP header, unfragmented encapsulation header, or fragment
    encapsulation header actually exists before we access it,
  - the encapsulated datagram or fragment is of nonzero size.

Reported-by: Eyal Itkin 
Reviewed-by: Eyal Itkin 
Fixes: CVE 2016-8633
Signed-off-by: Stefan Richter 
[bwh: Backported to 3.2: fwnet_receive_broadcast() never matches IPv6 packets]
Signed-off-by: Ben Hutchings

firewire: net: Fix handling of fragmented multicast/broadcast packets.

2013-01-03T03:33:24+00:00

commit 9d2373420900a39f5212a3b289331aa3535b1000 upstream.

This patch fixes both the transmit and receive portion of sending
fragmented mutlicast and broadcast packets.

The transmit section was broken because the offset for INTFRAG and
LASTFRAG packets were just miscalculated by IEEE1394_GASP_HDR_SIZE (which
was reserved with skb_push() in fwnet_send_packet).

The receive section was broken because in fwnet_incoming_packet is a call
to fwnet_peer_find_by_node_id(). Called with generation == -1 it will
not find a peer and the partial datagrams are associated to a peer.

[Stefan R:  The fix to use context->card->generation is not perfect.
It relies on the IR tasklet which processes packets from the prior bus
generation to run before the self-ID-complete worklet which sets the
current card generation.  Alas, there is no simple way of a race-free
implementation.  Let's do it this way for now.]

Signed-off-by: Stephan Gatzka 
Signed-off-by: Stefan Richter 
Signed-off-by: Ben Hutchings

firewire: net: Use posted writes

2011-10-09T15:00:18+00:00

Change memory region to ohci "middle address space". This effectively
reduces the number of packets by 50%.

[Stefan R.:]  This eliminates 1394 ack packets and improved throughput
by a few percent in some tests with an S400a connection with and without
gap count optimization.  Since firewire-net taxes the AR-req DMA unit of
a FireWire controller much more than firewire-sbp2 (which uses the
middle address space with PCI posted writes too), this commit also
changes a related error printk into a ratelimited one as a precaution.

Side note:  The IPv4-over-1394 drivers of Mac OS X 10.4, Windows XP SP3,
and the Thesycon 1394 bus driver for Windows all use the middle address
space too.

Signed-off-by: Stephan Gatzka 
Signed-off-by: Stefan Richter

firewire: use clamp and min3 macros

2011-10-09T15:00:18+00:00

Use kernel.h's convenience macros.  Also omit a printk that should never
happen and won't matter much if it ever happened.

Signed-off-by: Stefan Richter

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6

2011-07-22T21:49:48+00:00

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: document the sysfs ABIs
  firewire: cdev: ABI documentation enhancements
  firewire: cdev: prevent race between first get_info ioctl and bus reset event queuing
  firewire: cdev: return -ENOTTY for unimplemented ioctls, not -EINVAL
  firewire: ohci: skip soft reset retries after card ejection
  firewire: ohci: fix PHY reg access after card ejection
  firewire: ohci: add a comment on PHY reg access serialization
  firewire: ohci: reduce potential context_stop latency
  firewire: ohci: remove superfluous posted write flushes
  firewire: net: replacing deprecated __attribute__((packed)) with __packed

net: Push protocol type directly down to header_ops->cache()

2011-07-13T09:29:59+00:00

Signed-off-by: David S. Miller

firewire: net: replacing deprecated attribute((packed)) with __packed

2011-06-02T11:58:33+00:00

Fixing a deprecation, replacing __attribute__((packed)) with __packed.
It was deprecated for portability, specifically to avoid GCC specific
code.  See commit 82ddcb040570411fc2d421d96b3e69711c670328.

Signed-off-by: August Lilleaas 
Signed-off-by: Stefan Richter  (added include compiler.h)

firewire: optimize iso queueing by setting wake only after the last packet

2011-05-10T20:53:45+00:00

When queueing iso packets, the run time is dominated by the two
MMIO accesses that set the DMA context's wake bit.  Because most
drivers submit packets in batches, we can save much time by
removing all but the last wakeup.

The internal kernel API is changed to require a call to
fw_iso_context_queue_flush() after a batch of queued packets.
The user space API does not change, so one call to
FW_CDEV_IOC_QUEUE_ISO must specify multiple packets to take
advantage of this optimization.

In my measurements, this patch reduces the time needed to queue
fifty skip packets from userspace to one sixth on a 2.5 GHz CPU,
or to one third at 800 MHz.

Signed-off-by: Clemens Ladisch 
Signed-off-by: Stefan Richter

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi

firewire: net: invalidate ARP entries of removed nodes

2011-01-20T23:36:00+00:00

This makes it possible to resume communication with a node that dropped
off the bus for a brief period.  Otherwise communication will only be
possible after ARP cache entry timeouts.

Signed-off-by: Maxim Levitsky 
Signed-off-by: Stefan Richter  (rebased)