2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-23 20:53:53 +08:00
linux-next/drivers/net/e1000
Neil Horman ea30e11970 e1000: add missing length check to e1000 receive routine
Patch to fix bad length checking in e1000.  E1000 by default does two
things:

1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
doing an skb_put

Since the e1000 driver isn't written to support receiving packets that span
multiple rx buffers, it checks the End of Packet bit of every frame, and
discards it if its not set.  This places us in a situation where, if we have a
spanning packet, the first part is discarded, but the second part is not (since
it is the end of packet, and it passes the EOP bit test).  If the second part of
the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
underflow the length, and wind up in skb_over_panic, when we try to skb_put a
huge number of bytes into the skb.  This amounts to a remote DOS attack through
careful selection of frame size in relation to interface MTU.  The fix for this
is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
one ever pushed it to e1000.  This is lifted straight from e1000e, and prevents
small frames from causing the underflow described above

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Tested-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 01:29:58 -07:00
..
e1000_ethtool.c e1000: Use device_set_wakeup_enable 2008-11-16 01:35:56 -08:00
e1000_hw.c trivial: fix then -> than typos in comments and documentation 2009-01-06 11:28:06 +01:00
e1000_hw.h e1000: convert uint16_t style integers to u16 2008-04-16 20:41:45 -04:00
e1000_main.c e1000: add missing length check to e1000 receive routine 2009-06-02 01:29:58 -07:00
e1000_osdep.h e1000: Remove spaces after casts and function names 2008-07-22 19:38:52 -04:00
e1000_param.c e1000: fix stack size 2008-08-27 13:56:27 -07:00
e1000.h e1000: drop lltx, remove unnecessary lock 2009-01-21 14:42:47 -08:00
Makefile e100, e1000, ixgb: update copyright header and remove LICENSE 2006-09-27 12:53:14 -07:00