Eric Dumazet dc808110bb packet: handle too big packets for PACKET_V3 ... af_packet can currently overwrite kernel memory by out of bound accesses, because it assumed a [new] block can always hold one frame. This is not generally the case, even if most existing tools do it right. This patch clamps too long frames as API permits, and issue a one time error on syslog. [ 394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82 In this example, packet header tp_snaplen was set to 3966, and tp_len was set to 5042 (skb->len) Signed-off-by: Eric Dumazet <edumazet@google.com> Fixes: f6fb8f100b ("af-packet: TPACKET_V3 flexible buffer implementation.") Acked-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-08-21 16:44:28 -07:00
..
af_packet.c	packet: handle too big packets for PACKET_V3	2014-08-21 16:44:28 -07:00
diag.c	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-04-24 13:44:54 -04:00
internal.h	packet: handle too big packets for PACKET_V3	2014-08-21 16:44:28 -07:00
Kconfig	packet: Diag core and basic socket info dumping	2012-08-14 16:56:33 -07:00
Makefile	packet: Diag core and basic socket info dumping	2012-08-14 16:56:33 -07:00