From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:58800 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751606AbdIOGWb (ORCPT ); Fri, 15 Sep 2017 02:22:31 -0400 Subject: Patch "packet: Don't write vnet header beyond end of buffer" has been added to the 4.9-stable tree To: bpoirier@suse.com, davem@davemloft.net, gregkh@linuxfoundation.org, willemb@google.com Cc: , From: Date: Thu, 14 Sep 2017 23:22:15 -0700 Message-ID: <1505456535100230@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled packet: Don't write vnet header beyond end of buffer to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: packet-don-t-write-vnet-header-beyond-end-of-buffer.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Thu Sep 14 23:20:08 PDT 2017 From: Benjamin Poirier Date: Mon, 28 Aug 2017 14:29:41 -0400 Subject: packet: Don't write vnet header beyond end of buffer From: Benjamin Poirier [ Upstream commit edbd58be15a957f6a760c4a514cd475217eb97fd ] ... which may happen with certain values of tp_reserve and maclen. Fixes: 58d19b19cd99 ("packet: vnet_hdr support for tpacket_rcv") Signed-off-by: Benjamin Poirier Cc: Willem de Bruijn Acked-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/packet/af_packet.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2151,6 +2151,7 @@ static int tpacket_rcv(struct sk_buff *s struct timespec ts; __u32 ts_status; bool is_drop_n_account = false; + bool do_vnet = false; /* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT. * We may add members to them until current aligned size without forcing @@ -2201,8 +2202,10 @@ static int tpacket_rcv(struct sk_buff *s netoff = TPACKET_ALIGN(po->tp_hdrlen + (maclen < 16 ? 16 : maclen)) + po->tp_reserve; - if (po->has_vnet_hdr) + if (po->has_vnet_hdr) { netoff += sizeof(struct virtio_net_hdr); + do_vnet = true; + } macoff = netoff - maclen; } if (po->tp_version <= TPACKET_V2) { @@ -2219,8 +2222,10 @@ static int tpacket_rcv(struct sk_buff *s skb_set_owner_r(copy_skb, sk); } snaplen = po->rx_ring.frame_size - macoff; - if ((int)snaplen < 0) + if ((int)snaplen < 0) { snaplen = 0; + do_vnet = false; + } } } else if (unlikely(macoff + snaplen > GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len)) { @@ -2233,6 +2238,7 @@ static int tpacket_rcv(struct sk_buff *s if (unlikely((int)snaplen < 0)) { snaplen = 0; macoff = GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len; + do_vnet = false; } } spin_lock(&sk->sk_receive_queue.lock); @@ -2258,7 +2264,7 @@ static int tpacket_rcv(struct sk_buff *s } spin_unlock(&sk->sk_receive_queue.lock); - if (po->has_vnet_hdr) { + if (do_vnet) { if (__packet_rcv_vnet(skb, h.raw + macoff - sizeof(struct virtio_net_hdr))) { spin_lock(&sk->sk_receive_queue.lock); Patches currently in stable-queue which might be from bpoirier@suse.com are queue-4.9/packet-don-t-write-vnet-header-beyond-end-of-buffer.patch