https://github.com/torvalds/linux
Revision dc808110bb62b64a448696ecac3938902c92e1ab authored by Eric Dumazet on 15 August 2014, 16:16:04 UTC, committed by David S. Miller on 21 August 2014, 23:44:28 UTC
af_packet can currently overwrite kernel memory by out of bound
accesses, because it assumed a [new] block can always hold one frame.

This is not generally the case, even if most existing tools do it right.

This patch clamps too long frames as API permits, and issue a one time
error on syslog.

[  394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82

In this example, packet header tp_snaplen was set to 3966,
and tp_len was set to 5042 (skb->len)

Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 564ee36
History
Tip revision: dc808110bb62b64a448696ecac3938902c92e1ab authored by Eric Dumazet on 15 August 2014, 16:16:04 UTC
packet: handle too big packets for PACKET_V3
Tip revision: dc80811
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 1.1 KB
.mailmap -rw-r--r-- 4.7 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 93.8 KB
Kbuild -rw-r--r-- 2.5 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 278.0 KB
Makefile -rw-r--r-- 52.8 KB
README -rw-r--r-- 18.3 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top