summaryrefslogtreecommitdiff
path: root/net/packet/internal.h
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2014-08-15 20:16:04 +0400
committerDavid S. Miller <davem@davemloft.net>2014-08-22 03:44:28 +0400
commitdc808110bb62b64a448696ecac3938902c92e1ab (patch)
tree05abe4d611d696d3b64c24c9cfac048b6d9db0f0 /net/packet/internal.h
parent564ee3606fe6c9e014c4bee9d74a5eaef96034c8 (diff)
downloadlinux-dc808110bb62b64a448696ecac3938902c92e1ab.tar.xz
packet: handle too big packets for PACKET_V3
af_packet can currently overwrite kernel memory by out of bound accesses, because it assumed a [new] block can always hold one frame. This is not generally the case, even if most existing tools do it right. This patch clamps too long frames as API permits, and issue a one time error on syslog. [ 394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82 In this example, packet header tp_snaplen was set to 3966, and tp_len was set to 5042 (skb->len) Signed-off-by: Eric Dumazet <edumazet@google.com> Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") Acked-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/packet/internal.h')
-rw-r--r--net/packet/internal.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/packet/internal.h b/net/packet/internal.h
index eb9580a6b25f..cdddf6a30399 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -29,6 +29,7 @@ struct tpacket_kbdq_core {
char *pkblk_start;
char *pkblk_end;
int kblk_size;
+ unsigned int max_frame_len;
unsigned int knum_blocks;
uint64_t knxt_seq_num;
char *prev;