From mboxrd@z Thu Jan 1 00:00:00 1970 From: Neil Horman Subject: Re: [PATCH] e1000: enhance frame fragment detection Date: Wed, 6 Jan 2010 19:56:29 -0500 Message-ID: <20100107005629.GA2020@localhost.localdomain> References: <20091228201005.GC18422@hmsreliant.think-freely.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: "netdev@vger.kernel.org" , "davem@davemloft.net" , "Kirsher, Jeffrey T" , "Allan, Bruce W" , "Waskiewicz Jr, Peter P" , "Ronciak, John" , "e1000-devel@lists.sourceforge.net" To: "Brandeburg, Jesse" Return-path: Received: from charlotte.tuxdriver.com ([70.61.120.58]:55902 "EHLO smtp.tuxdriver.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752246Ab0AGA4f (ORCPT ); Wed, 6 Jan 2010 19:56:35 -0500 Content-Disposition: inline In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On Wed, Jan 06, 2010 at 03:27:42PM -0800, Brandeburg, Jesse wrote: > a counter patch, without atomic ops, since we are protected by napi when > modifying this variable. > > Originally From: Neil Horman > Modified by: Jesse Brandeburg > > > Hey all- > A security discussion was recently given: > http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html > And a patch that I submitted awhile back was brought up. Apparently some of > their testing revealed that they were able to force a buffer fragment in e1000 > in which the trailing fragment was greater than 4 bytes. As a result the > fragment check I introduced failed to detect the fragement and a partial > invalid frame was passed up into the network stack. I've written this patch > to correct it. I'm in the process of testing it now, but it makes good > logical sense to me. Effectively it maintains a per-adapter state variable > which detects a non-EOP frame, and discards it and subsequent non-EOP frames > leading up to _and_ _including_ the next positive-EOP frame (as it is by > definition the last fragment). This should prevent any and all partial frames > from entering the network stack from e1000. > > Signed-off-by: Jesse Brandeburg Seems like a fine alternative to me. Thanks! Acked-by: Neil Horman