From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:36100 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753612AbbIZSmP (ORCPT ); Sat, 26 Sep 2015 14:42:15 -0400 Subject: Patch "packet: tpacket_snd(): fix signed/unsigned comparison" has been added to the 4.1-stable tree To: al.drozdov@gmail.com, daniel@iogearbox.net, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Sat, 26 Sep 2015 11:42:15 -0700 Message-ID: <144329293520638@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled packet: tpacket_snd(): fix signed/unsigned comparison to the 4.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: packet-tpacket_snd-fix-signed-unsigned-comparison.patch and it can be found in the queue-4.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Sat Sep 26 11:13:07 PDT 2015 From: Alexander Drozdov Date: Tue, 28 Jul 2015 13:57:01 +0300 Subject: packet: tpacket_snd(): fix signed/unsigned comparison From: Alexander Drozdov [ Upstream commit dbd46ab412b8fb395f2b0ff6f6a7eec9df311550 ] tpacket_fill_skb() can return a negative value (-errno) which is stored in tp_len variable. In that case the following condition will be (but shouldn't be) true: tp_len > dev->mtu + dev->hard_header_len as dev->mtu and dev->hard_header_len are both unsigned. That may lead to just returning an incorrect EMSGSIZE errno to the user. Fixes: 52f1454f629fa ("packet: allow to transmit +4 byte in TX_RING slot for VLAN case") Signed-off-by: Alexander Drozdov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/packet/af_packet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2307,7 +2307,8 @@ static int tpacket_snd(struct packet_soc } tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto, addr, hlen); - if (tp_len > dev->mtu + dev->hard_header_len) { + if (likely(tp_len >= 0) && + tp_len > dev->mtu + dev->hard_header_len) { struct ethhdr *ehdr; /* Earlier code assumed this would be a VLAN pkt, * double-check this now that we have the actual Patches currently in stable-queue which might be from al.drozdov@gmail.com are queue-4.1/packet-tpacket_snd-fix-signed-unsigned-comparison.patch