linux-stable.git/net/packet, branch v3.18.22

packet: avoid out of bounds read in round robin fanout

2015-07-05T14:12:58+00:00

[ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ]

PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
f->num_members. It returns the old value unconditionally, but
f->num_members may have changed since the last store. Ensure
that the return value is always < num.

When modifying the logic, simplify it further by replacing the loop
with an unconditional atomic increment.

Fixes: dc99f600698d ("packet: Add fanout support.")
Suggested-by: Eric Dumazet 
Signed-off-by: Willem de Bruijn 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

packet: read num_members once in packet_rcv_fanout()

2015-07-05T14:12:58+00:00

[ Upstream commit f98f4514d07871da7a113dd9e3e330743fd70ae4 ]

We need to tell compiler it must not read f->num_members multiple
times. Otherwise testing if num is not zero is flaky, and we could
attempt an invalid divide by 0 in fanout_demux_cpu()

Note bug was present in packet_rcv_fanout_hash() and
packet_rcv_fanout_lb() but final 3.1 had a simple location
after commit 95ec3eb417115fb ("packet: Add 'cpu' fanout policy.")

Fixes: dc99f600698dc ("packet: Add fanout support.")
Signed-off-by: Eric Dumazet 
Cc: Willem de Bruijn 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

af_packet: fix sparse warning

2014-11-24T21:15:36+00:00

af_packet produces lots of these:
	net/packet/af_packet.c:384:39: warning: incorrect type in return expression (different modifiers)
	net/packet/af_packet.c:384:39:    expected struct page [pure] *
	net/packet/af_packet.c:384:39:    got struct page *

this seems to be because sparse does not realize that _pure
refers to function, not the returned pointer.

Tweak code slightly to avoid the warning.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

net: Pass a "more" indication down into netdev_start_xmit() code paths.

2014-09-02T00:39:55+00:00

For now it will always be false.

Signed-off-by: David S. Miller

net: Do txq_trans_update() in netdev_start_xmit()

2014-09-02T00:39:55+00:00

That way we don't have to audit every call site to make sure it is
doing this properly.

Signed-off-by: David S. Miller

net: add skb_get_tx_queue() helper

2014-08-30T03:02:07+00:00

Replace occurences of skb_get_queue_mapping() and follow-up
netdev_get_tx_queue() with an actual helper function.

Signed-off-by: Daniel Borkmann 
Signed-off-by: David S. Miller

net: Add ops->ndo_xmit_flush()

2014-08-25T06:02:45+00:00

Signed-off-by: David S. Miller

packet: handle too big packets for PACKET_V3

2014-08-21T23:44:28+00:00

af_packet can currently overwrite kernel memory by out of bound
accesses, because it assumed a [new] block can always hold one frame.

This is not generally the case, even if most existing tools do it right.

This patch clamps too long frames as API permits, and issue a one time
error on syslog.

[  394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82

In this example, packet header tp_snaplen was set to 3966,
and tp_len was set to 5042 (skb->len)

Signed-off-by: Eric Dumazet 
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Acked-by: Daniel Borkmann 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller

packet: remove deprecated syststamp timestamp

2014-07-29T18:39:50+00:00

No device driver will ever return an skb_shared_info structure with
syststamp non-zero, so remove the branch that tests for this and
optionally marks the packet timestamp as TP_STATUS_TS_SYS_HARDWARE.

Do not remove the definition TP_STATUS_TS_SYS_HARDWARE, as processes
may refer to it.

Signed-off-by: Willem de Bruijn 
Signed-off-by: David S. Miller

packet: remove unnecessary break after return

2014-07-15T23:26:59+00:00

Signed-off-by: Fabian Frederick 
Signed-off-by: David S. Miller