Eric Dumazet dc808110bb packet: handle too big packets for PACKET_V3 ... af_packet can currently overwrite kernel memory by out of bound accesses, because it assumed a [new] block can always hold one frame. This is not generally the case, even if most existing tools do it right. This patch clamps too long frames as API permits, and issue a one time error on syslog. [ 394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82 In this example, packet header tp_snaplen was set to 3966, and tp_len was set to 5042 (skb->len) Signed-off-by: Eric Dumazet <edumazet@google.com> Fixes: f6fb8f100b ("af-packet: TPACKET_V3 flexible buffer implementation.") Acked-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-08-21 16:44:28 -07:00
..
6lowpan	6lowpan: Allow 6LoWPAN to be modular	2014-08-07 11:44:18 -07:00
9p	9P: remove unnecessary break after return	2014-07-15 16:27:00 -07:00
802	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
8021q	net: Always untag vlan-tagged traffic on input.	2014-08-11 12:16:51 -07:00
appletalk	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-07-16 14:09:34 -07:00
atm	lec: Use rtnl lock/unlock when updating MTU	2014-08-21 16:31:23 -07:00
ax25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
batman-adv	batman-adv: Fix parameter order of hlist_add_behind	2014-08-16 19:19:08 -07:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-08-06 09:38:14 -07:00
bridge	net: Always untag vlan-tagged traffic on input.	2014-08-11 12:16:51 -07:00
caif	caif: remove unnecessary break after goto	2014-07-15 16:27:01 -07:00
can	can: add hash based access to single EFF frame filters	2014-05-19 09:38:24 +02:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2014-08-13 17:43:29 -06:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-08-13 18:27:40 -06:00
dcb	dcbnl : Fix misleading dcb_app->priority explanation	2014-07-30 17:21:05 -07:00
dccp	inet: move ipv6only in sock_common	2014-07-01 23:46:21 -07:00
decnet	net: Split sk_no_check into sk_no_check_{rx,tx}	2014-05-23 16:28:53 -04:00
dns_resolver	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2014-08-06 08:06:39 -07:00
dsa	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
ethernet	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
hsr	net/hsr: Remove left-over never-true conditional code.	2014-07-11 15:04:40 -07:00
ieee802154	inet: frags: use kmem_cache for inet_frag_queue	2014-08-02 15:31:31 -07:00
ipv4	tcp: fix ssthresh and undo for consecutive short FRTO episodes	2014-08-14 14:38:55 -07:00
ipv6	tcp: fix tcp_release_cb() to dispatch via address family for mtu_reduced()	2014-08-14 14:38:54 -07:00
ipx	net: Split sk_no_check into sk_no_check_{rx,tx}	2014-05-23 16:28:53 -04:00
irda	irda: Fix rd_frame control field initialization in irlap_send_rd_frame()	2014-08-13 20:05:52 -07:00
iucv	af_iucv: avoid path quiesce of severed path in shutdown()	2014-07-21 20:21:40 -07:00
key	af_key: remove unnecessary break after return	2014-07-15 16:27:00 -07:00
l2tp	net: use inet6_iif instead of IP6CB()->iif	2014-07-31 22:37:06 -07:00
lapb
llc	llc: remove noisy WARN from llc_mac_hdr_init	2014-01-28 18:01:32 -08:00
mac80211	Merge tag 'master-2014-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next	2014-07-28 17:36:25 -07:00
mac802154	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
mpls	gre: Call gso_make_checksum	2014-06-04 22:46:38 -07:00
netfilter	netfilter: nf_tables: fix error return code	2014-08-08 16:47:29 +02:00
netlabel	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-08-06 09:38:14 -07:00
netlink	netlink: Annotate RCU locking for seq_file walker	2014-08-14 15:13:40 -07:00
netrom	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
nfc	Merge tag 'master-2014-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next	2014-08-05 13:18:20 -07:00
openvswitch	openvswitch: Fix memory leak in ovs_vport_alloc() error path	2014-08-13 20:04:46 -07:00
packet	packet: handle too big packets for PACKET_V3	2014-08-21 16:44:28 -07:00
phonet	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-06-12 14:27:40 -07:00
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next	2014-05-22 13:58:36 -04:00
rose	net: set name_assign_type in alloc_netdev()	2014-07-15 16:12:48 -07:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-08-06 09:38:14 -07:00
sched	cbq: now_rt removal	2014-08-19 10:58:44 -07:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-08-05 18:46:26 -07:00
sunrpc	NFS client updates for Linux 3.17	2014-08-13 18:13:19 -06:00
tipc	tipc: Fix build.	2014-08-19 11:16:38 -07:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-06-12 14:27:40 -07:00
vmw_vsock	vsock: Make transport the proto owner	2014-05-05 13:13:50 -04:00
wimax
wireless	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless	2014-07-25 10:22:36 -04:00
x25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
xfrm	list: fix order of arguments for hlist_add_after(_rcu)	2014-08-06 18:01:24 -07:00
compat.c	net: sendmsg: fix NULL pointer dereference	2014-07-29 12:20:22 -07:00
Kconfig	6lowpan: introduce new net/6lowpan directory	2014-07-12 01:53:30 +02:00
Makefile	6lowpan: introduce new net/6lowpan directory	2014-07-12 01:53:30 +02:00
nonet.c
socket.c	net-timestamp: sock_tx_timestamp() fix	2014-08-06 12:38:07 -07:00
sysctl_net.c