kevin/linux
1
Fork 0
Code
0e7ddf7eee
linux/drivers/net
History
Neil Horman ea30e11970 e1000: add missing length check to e1000 receive routine 
Patch to fix bad length checking in e1000.  E1000 by default does two
things:

1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
doing an skb_put

Since the e1000 driver isn't written to support receiving packets that span
multiple rx buffers, it checks the End of Packet bit of every frame, and
discards it if its not set.  This places us in a situation where, if we have a
spanning packet, the first part is discarded, but the second part is not (since
it is the end of packet, and it passes the EOP bit test).  If the second part of
the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
underflow the length, and wind up in skb_over_panic, when we try to skb_put a
huge number of bytes into the skb.  This amounts to a remote DOS attack through
careful selection of frame size in relation to interface MTU.  The fix for this
is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
one ever pushed it to e1000.  This is lifted straight from e1000e, and prevents
small frames from causing the underflow described above

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Tested-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 01:29:58 -07:00
..
appletalk
arcnet
arm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-05-10 10:46:45 -07:00
atl1c
atl1e ath1e: add new device id for asus hardware 2009-05-29 22:04:54 -07:00
atlx atlx: move modinfo data from atlx.h to atl1.c 2009-05-26 20:50:12 -07:00
benet be2net: add two new pci device ids to pci device table 2009-05-18 15:38:55 -07:00
bonding bonding: fix link down handling in 802.3ad mode 2009-05-17 21:15:54 -07:00
can
chelsio
cris
cxgb3 cxgb3: link fault fixes 2009-05-29 01:54:41 -07:00
e1000 e1000: add missing length check to e1000 receive routine 2009-06-02 01:29:58 -07:00
e1000e
ehea ehea: fix invalid pointer access 2009-05-04 11:06:37 -07:00
enic
fs_enet
hamradio
ibm_newemac
igb igb: resolve panic on shutdown when SR-IOV is enabled 2009-05-06 16:43:48 -07:00
igbvf
irda
ixgb
ixgbe ixgbe: Fix WoL functionality for 82599 KX4 devices 2009-04-27 03:14:48 -07:00
ixp2000
mlx4 mlx4_en: Fix a kernel panic when waking tx queue 2009-05-29 22:04:42 -07:00
myri10ge
netxen
pcmcia pcnet_cs: add cis(firmware) of the Allied Telesis LA-PCM 2009-04-21 02:06:14 -07:00
phy
qlge
sfc
skfp
tokenring
tulip
usb usbnet: CDC EEM support (v5) 2009-05-04 12:01:43 -07:00
vxge Neterion: *FIFO1_DMA_ERR set twice, should 2nd be *FIFO2_DMA_ERR? 2009-05-17 21:18:05 -07:00
wan IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization. 2009-05-09 14:55:52 +02:00
wimax wimax/i2400m: usb: fix device reset on autosuspend while not yet idle 2009-05-22 00:13:18 -07:00
wireless rtl8187: add USB ID for Linksys WUSB54GC-EU v2 USB wifi dongle 2009-05-29 12:41:01 +02:00
3c59x.c
3c501.c
3c501.h
3c503.c
3c503.h
3c505.c
3c505.h
3c507.c
3c509.c 3c509: Add missing EISA IDs 2009-06-01 03:12:04 -07:00
3c515.c
3c523.c
3c523.h
3c527.c
3c527.h
7990.c
7990.h
8139cp.c
8139too.c 8139too: fix HW initial flow 2009-04-22 00:43:24 -07:00
8390.c
8390.h
8390p.c
82596.c
a2065.c
a2065.h
ac3200.c
acenic.c
acenic.h
amd8111e.c
amd8111e.h
apne.c
ariadne.c
ariadne.h
at1700.c
atarilance.c
atp.c
atp.h
au1000_eth.c
au1000_eth.h
ax88796.c
b44.c
b44.h
bfin_mac.c bfin_mac: fix build error due to net_device_ops convert 2009-05-26 20:55:33 -07:00
bfin_mac.h
bmac.c
bmac.h
bnx2_fw.h
bnx2.c bnx2: Fix panic in bnx2_poll_work(). 2009-05-06 16:46:47 -07:00
bnx2.h
bnx2x_dump.h
bnx2x_fw_defs.h
bnx2x_hsi.h
bnx2x_init_values.h
bnx2x_init.h
bnx2x_link.c
bnx2x_link.h
bnx2x_main.c
bnx2x_reg.h
bnx2x.h
bsd_comp.c
cassini.c
cassini.h
cpmac.c
cs89x0.c
cs89x0.h
de600.c
de600.h
de620.c
de620.h
declance.c
defxx.c
defxx.h
depca.c
depca.h
dl2k.c
dl2k.h
dm9000.c
dm9000.h
dnet.c
dnet.h
dummy.c
e100.c e100: do not go D3 in shutdown unless system is powering off 2009-04-28 22:42:39 -07:00
e2100.c
eepro.c
eexpress.c
eexpress.h
enc28j60_hw.h
enc28j60.c
epic100.c
eql.c
es3210.c
eth16i.c
ethoc.c
ewrk3.c
ewrk3.h
fealnx.c
fec_mpc52xx_phy.c
fec_mpc52xx.c
fec_mpc52xx.h
fec.c
fec.h
forcedeth.c forcedeth: add phy_power_down parameter, leave phy powered up by default (v2) 2009-06-02 00:19:52 -07:00
fsl_pq_mdio.c
fsl_pq_mdio.h
gianfar_ethtool.c
gianfar_sysfs.c
gianfar.c gianfar: fix BUG under load after introduction of skb recycling 2009-05-25 00:42:34 -07:00
gianfar.h gianfar: fix babbling rx error event bug 2009-05-26 20:48:04 -07:00
hamachi.c
hp100.c
hp100.h
hp-plus.c
hp.c
hplance.c
hplance.h
hydra.c
ibmlana.c
ibmlana.h
ibmveth.c
ibmveth.h
ifb.c
ioc3-eth.c
ipg.c
ipg.h
isa-skeleton.c
iseries_veth.c
jazzsonic.c
jme.c
jme.h
Kconfig
korina.c
lance.c
lasi_82596.c
lib8390.c
lib82596.c
LICENSE.SRC
lne390.c
loopback.c
lp486e.c
mac89x0.c
mac8390.c mac8390: fix build with NET_POLL_CONTROLLER 2009-05-29 01:56:35 -07:00
macb.c
macb.h
mace.c
mace.h
macmace.c
macsonic.c
macvlan.c
Makefile mac8390: fix regression caused during net_device_ops conversion 2009-05-25 22:43:49 -07:00
meth.c NET: Meth: Fix unsafe mix of irq and non-irq spinlocks. 2009-05-17 21:11:36 -07:00
meth.h
mii.c
mipsnet.c
mv643xx_eth.c mv643xx_eth: fix PPC DMA breakage 2009-05-17 21:16:47 -07:00
mvme147.c
myri_sbus.c
myri_sbus.h
natsemi.c
ne2.c
ne2k-pci.c ne2k-pci: Do not register device until initialized. 2009-05-02 13:52:13 -07:00
ne3210.c
ne-h8300.c
ne.c
netconsole.c netconsole: take care of NETDEV_UNREGISTER event 2009-05-01 15:24:18 -07:00
netx-eth.c
ni52.c
ni52.h
ni65.c
ni65.h
ni5010.c
ni5010.h
niu.c
niu.h
ns83820.c
pasemi_mac_ethtool.c
pasemi_mac.c
pasemi_mac.h
pci-skeleton.c
pcnet32.c
plip.c
ppp_async.c
ppp_deflate.c
ppp_generic.c
ppp_mppe.c
ppp_mppe.h
ppp_synctty.c
pppoe.c
pppol2tp.c
pppox.c
ps3_gelic_net.c
ps3_gelic_net.h
ps3_gelic_wireless.c
ps3_gelic_wireless.h
qla3xxx.c
qla3xxx.h
r6040.c
r8169.c r8169: avoid losing MSI interrupts 2009-05-25 22:55:26 -07:00
rionet.c
rrunner.c
rrunner.h
s2io-regs.h
s2io.c
s2io.h
sb1000.c
sb1250-mac.c
sc92031.c
seeq8005.c
seeq8005.h
sgiseeq.c
sgiseeq.h
sh_eth.c
sh_eth.h
sis190.c
sis900.c
sis900.h
skge.c
skge.h
sky2.c
sky2.h
slhc.c
slip.c
slip.h
smc91x.c
smc91x.h
smc911x.c
smc911x.h
smc9194.c
smc9194.h
smc-mca.c
smc-ultra32.c
smc-ultra.c
smsc911x.c
smsc911x.h
smsc9420.c
smsc9420.h
sni_82596.c
sonic.c
sonic.h
Space.c
spider_net_ethtool.c
spider_net.c
spider_net.h
starfire.c
stnic.c
sun3_82586.c
sun3_82586.h
sun3lance.c
sunbmac.c
sunbmac.h
sundance.c
sungem_phy.c
sungem_phy.h
sungem.c
sungem.h
sunhme.c
sunhme.h
sunlance.c
sunqe.c
sunqe.h
sunvnet.c
sunvnet.h
tc35815.c
tehuti.c
tehuti.h
tg3.c tg3: Fix SEEPROM accesses 2009-04-20 14:52:29 -07:00
tg3.h
tlan.c
tlan.h
tsi108_eth.c
tsi108_eth.h
tun.c
typhoon.c
typhoon.h
ucc_geth_ethtool.c
ucc_geth.c ucc_geth.c: Fix upsmr setting in RMII mode 2009-04-22 00:46:08 -07:00
ucc_geth.h
veth.c veth: prevent oops caused by netdev destructor 2009-04-27 03:04:58 -07:00
via-rhine.c
via-velocity.c
via-velocity.h
virtio_net.c virtio_net: Fix function name typo 2009-05-01 21:26:36 -07:00
wd.c
xen-netfront.c
xtsonic.c
yellowfin.c
znet.c
zorro8390.c