]> git.baikalelectronics.ru Git - kernel.git/commit
packet: handle too big packets for PACKET_V3
authorEric Dumazet <edumazet@google.com>
Fri, 15 Aug 2014 16:16:04 +0000 (09:16 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 21 Aug 2014 23:44:28 +0000 (16:44 -0700)
commita1bc4290de6f9713524664211c0403b4be1679c0
tree05abe4d611d696d3b64c24c9cfac048b6d9db0f0
parent09de93f7760d65afbbe4574c067841e04c9670a5
packet: handle too big packets for PACKET_V3

af_packet can currently overwrite kernel memory by out of bound
accesses, because it assumed a [new] block can always hold one frame.

This is not generally the case, even if most existing tools do it right.

This patch clamps too long frames as API permits, and issue a one time
error on syslog.

[  394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82

In this example, packet header tp_snaplen was set to 3966,
and tp_len was set to 5042 (skb->len)

Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: 7fa5f1dbc2ee ("af-packet: TPACKET_V3 flexible buffer implementation.")
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/packet/af_packet.c
net/packet/internal.h