kevin/linux
1
Fork 0
Code
739e0285cb
linux/drivers/net
History
Eric Dumazet fdd7b4c330 r8169: fix crash when large packets are received 
Michael Tokarev reported receiving a large packet could crash
a machine with RTL8169 NIC.
( original thread at http://lkml.org/lkml/2009/6/8/192 )

Problem is this driver tells that NIC frames up to 16383 bytes
can be received but provides skb to rx ring allocated with
smaller sizes (1536 bytes in case standard 1500 bytes MTU is used)

When a frame larger than what was allocated by driver is received,
dma transfert can occurs past the end of buffer and corrupt
kernel memory.

Fix is to tell to NIC what is the maximum size a frame can be.

This bug is very old, (before git introduction, linux-2.6.10), and 
should be backported to stable versions.

Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-09 04:01:02 -07:00
..
appletalk appletalk: convert LTPC to net_device_ops 2009-03-27 00:46:42 -07:00
arcnet
arm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-05-10 10:46:45 -07:00
atl1c Replace all DMA_nBIT_MASK macro with DMA_BIT_MASK(n) 2009-04-13 15:04:33 -07:00
atl1e ath1e: add new device id for asus hardware 2009-05-29 22:04:54 -07:00
atlx atlx: move modinfo data from atlx.h to atl1.c 2009-05-26 20:50:12 -07:00
benet be2net: add two new pci device ids to pci device table 2009-05-18 15:38:55 -07:00
bonding bonding: fix link down handling in 802.3ad mode 2009-05-17 21:15:54 -07:00
can
chelsio dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
cris eth_v10: convert to net_device_ops 2009-04-13 15:16:33 -07:00
cxgb3 cxgb3: link fault fixes 2009-05-29 01:54:41 -07:00
e1000 e1000: add missing length check to e1000 receive routine 2009-06-02 01:29:58 -07:00
e1000e e1000e: fix bug in restart queue logic 2009-04-17 01:09:58 -07:00
ehea ehea: fix invalid pointer access 2009-05-04 11:06:37 -07:00
enic dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
fs_enet fs_enet: convert to netdev_ops 2009-04-11 02:06:43 -07:00
hamradio Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jaswinder/net-next-2.6 2009-03-31 14:43:54 -07:00
ibm_newemac ibm_newemac: convert to netdev_ops 2009-04-11 02:06:45 -07:00
igb igb: resolve panic on shutdown when SR-IOV is enabled 2009-05-06 16:43:48 -07:00
igbvf igbvf: fix unused external references 2009-04-11 02:55:14 -07:00
irda proc 2/2: remove struct proc_dir_entry::owner 2009-03-31 01:14:44 +04:00
ixgb dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
ixgbe ixgbe: Fix WoL functionality for 82599 KX4 devices 2009-04-27 03:14:48 -07:00
ixp2000
mlx4 mlx4_en: Fix a kernel panic when waking tx queue 2009-05-29 22:04:42 -07:00
myri10ge myr10ge: again fix lro_gen_skb() alignment 2009-04-15 02:29:33 -07:00
netxen dma-mapping: replace all DMA_39BIT_MASK macro with DMA_BIT_MASK(39) 2009-04-07 08:31:11 -07:00
pcmcia pcnet_cs: add cis(firmware) of the Allied Telesis LA-PCM 2009-04-21 02:06:14 -07:00
phy phylib: Fix delay argument of schedule_delayed_work 2009-04-16 03:13:07 -07:00
qlge dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sfc sfc: Use correct macro to set event bitfield 2009-04-14 19:48:34 -07:00
skfp trivial: fix typo "varaible" -> "variable" 2009-03-30 15:21:57 +02:00
tokenring dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
tulip dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
usb usbnet: CDC EEM support (v5) 2009-05-04 12:01:43 -07:00
vxge Neterion: *FIFO1_DMA_ERR set twice, should 2nd be *FIFO2_DMA_ERR? 2009-05-17 21:18:05 -07:00
wan IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization. 2009-05-09 14:55:52 +02:00
wimax wimax/i2400m: usb: fix device reset on autosuspend while not yet idle 2009-05-22 00:13:18 -07:00
wireless rtl8187: add USB ID for Linksys WUSB54GC-EU v2 USB wifi dongle 2009-05-29 12:41:01 +02:00
3c59x.c
3c501.c
3c501.h
3c503.c 3c503, smc-ultra: netdev_ops bugs 2009-03-27 00:46:38 -07:00
3c503.h
3c505.c
3c505.h
3c507.c
3c509.c 3c509: Add missing EISA IDs 2009-06-01 03:12:04 -07:00
3c515.c
3c523.c
3c523.h
3c527.c
3c527.h
7990.c
7990.h
8139cp.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
8139too.c 8139too: fix HW initial flow 2009-04-22 00:43:24 -07:00
8390.c
8390.h
8390p.c
82596.c
a2065.c a2065: convert to net_device_ops 2009-04-14 21:57:00 -07:00
a2065.h
ac3200.c netdev: convert ac3200 to net_device_ops 2009-03-27 00:46:54 -07:00
acenic.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
acenic.h
amd8111e.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
amd8111e.h
apne.c
ariadne.c ariadne: convert to net_device_ops 2009-04-11 02:53:46 -07:00
ariadne.h
at1700.c netdev: convert at1700 to net_device_ops 2009-03-27 00:46:51 -07:00
atarilance.c atarilance: convert to net_device_ops 2009-04-14 21:57:01 -07:00
atp.c
atp.h
au1000_eth.c au1000: convert to net_device_ops 2009-04-14 21:57:02 -07:00
au1000_eth.h
ax88796.c ax88796: Add method to take MAC from platform data 2009-03-24 23:32:03 -07:00
b44.c dma-mapping: replace all DMA_30BIT_MASK macro with DMA_BIT_MASK(30) 2009-04-07 08:31:11 -07:00
b44.h
bfin_mac.c bfin_mac: fix build error due to net_device_ops convert 2009-05-26 20:55:33 -07:00
bfin_mac.h
bmac.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
bmac.h
bnx2_fw.h bnx2: Use request_firmware() 2009-04-04 16:51:14 -07:00
bnx2.c bnx2: Fix panic in bnx2_poll_work(). 2009-05-06 16:46:47 -07:00
bnx2.h bnx2: Use request_firmware() 2009-04-04 16:51:14 -07:00
bnx2x_dump.h bnx2x: Register dump 2009-03-02 22:32:48 -08:00
bnx2x_fw_defs.h
bnx2x_hsi.h
bnx2x_init_values.h bnx2x: Adding licensing to bnx2x_init_values.h 2009-03-22 21:24:19 -07:00
bnx2x_init.h bnx2x: Using DMAE to initialize the chip 2009-03-10 04:52:03 -07:00
bnx2x_link.c bnx2x: Loopback support at external PHY 2009-03-02 22:32:45 -08:00
bnx2x_link.h
bnx2x_main.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
bnx2x_reg.h bnx2x: Supporting new BCM8726 FW 2009-03-02 22:32:43 -08:00
bnx2x.h Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-03-10 05:04:16 -07:00
bsd_comp.c
cassini.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
cassini.h
cpmac.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
cs89x0.c netdev: convert cs89x0 to net_device_ops 2009-03-27 00:46:55 -07:00
cs89x0.h
de600.c
de600.h
de620.c
de620.h
declance.c declance: convert to net_device_ops 2009-04-14 21:57:04 -07:00
defxx.c
defxx.h
depca.c netdev: convert depca to net_device_ops 2009-03-27 00:46:52 -07:00
depca.h
dl2k.c dma-mapping: replace all DMA_48BIT_MASK macro with DMA_BIT_MASK(48) 2009-04-07 08:31:10 -07:00
dl2k.h
dm9000.c workqueue: add to_delayed_work() helper function 2009-04-02 19:04:50 -07:00
dm9000.h
dnet.c dnet: remove unused #include <version.h> 2009-04-02 16:31:45 -07:00
dnet.h dnet: Dave DNET ethernet controller driver (updated) 2009-03-11 23:26:02 -07:00
dummy.c
e100.c e100: do not go D3 in shutdown unless system is powering off 2009-04-28 22:42:39 -07:00
e2100.c
eepro.c netdev: convert eexpro to net_device_ops 2009-03-27 00:46:51 -07:00
eexpress.c netdev: convert eexpress to net_device_ops 2009-03-27 00:46:50 -07:00
eexpress.h
enc28j60_hw.h
enc28j60.c
epic100.c
eql.c drivers/net/eql.c: Fix a dev leakage. 2009-04-08 15:56:33 -07:00
es3210.c
eth16i.c netdev: convert eth16i to net_device_ops 2009-03-27 00:46:55 -07:00
ethoc.c net: Add support for the OpenCores 10/100 Mbps Ethernet MAC. 2009-03-27 00:16:21 -07:00
ewrk3.c netdev: convert ewrk3 to net_device_ops 2009-03-27 00:46:52 -07:00
ewrk3.h
fealnx.c
fec_mpc52xx_phy.c
fec_mpc52xx.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-04-02 21:05:30 -07:00
fec_mpc52xx.h
fec.c FEC driver: add missing #endif 2009-04-08 15:44:45 -07:00
fec.h
forcedeth.c forcedeth: add phy_power_down parameter, leave phy powered up by default (v2) 2009-06-02 00:19:52 -07:00
fsl_pq_mdio.c fsl_pq_mdio: Fix compile failure 2009-04-02 13:57:30 -07:00
fsl_pq_mdio.h
gianfar_ethtool.c
gianfar_sysfs.c
gianfar.c gianfar: fix BUG under load after introduction of skb recycling 2009-05-25 00:42:34 -07:00
gianfar.h gianfar: fix babbling rx error event bug 2009-05-26 20:48:04 -07:00
hamachi.c
hp100.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
hp100.h
hp-plus.c
hp.c
hplance.c
hplance.h
hydra.c
ibmlana.c netdev: ibmlana convert to net_device_ops 2009-03-27 00:46:49 -07:00
ibmlana.h
ibmveth.c
ibmveth.h
ifb.c
ioc3-eth.c ioc3-eth: convert to net_device_ops 2009-04-13 15:16:31 -07:00
ipg.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
ipg.h
isa-skeleton.c isa-skeleton: convert to net_device_ops 2009-04-13 15:16:30 -07:00
iseries_veth.c
jazzsonic.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
jme.c Replace all DMA_nBIT_MASK macro with DMA_BIT_MASK(n) 2009-04-13 15:04:33 -07:00
jme.h jme: Advance version number after previous changes 2009-03-02 01:55:15 -08:00
Kconfig net: fix "compatibility" typos 2009-04-20 02:15:01 -07:00
korina.c
lance.c lance: convert to net_device_ops 2009-03-27 00:46:48 -07:00
lasi_82596.c
lib8390.c
lib82596.c
LICENSE.SRC
lne390.c
loopback.c
lp486e.c netdev: convert lp486e to net_device_ops 2009-03-27 00:46:54 -07:00
mac89x0.c mac89x0: convert to net_device_ops 2009-04-13 15:16:29 -07:00
mac8390.c mac8390: fix build with NET_POLL_CONTROLLER 2009-05-29 01:56:35 -07:00
macb.c macb: process the RX ring regardless of interrupt status 2009-04-17 01:30:34 -07:00
macb.h
mace.c
mace.h
macmace.c
macsonic.c macsonic: convert to net_device_ops 2009-04-13 15:16:26 -07:00
macvlan.c vlan/macvlan: fix NULL pointer dereferences in ethtool handlers 2009-04-17 15:59:23 -07:00
Makefile mac8390: fix regression caused during net_device_ops conversion 2009-05-25 22:43:49 -07:00
meth.c NET: Meth: Fix unsafe mix of irq and non-irq spinlocks. 2009-05-17 21:11:36 -07:00
meth.h
mii.c
mipsnet.c platform driver: fix incorrect use of 'platform_bus_type' with 'struct device_driver' 2009-03-24 16:38:25 -07:00
mv643xx_eth.c mv643xx_eth: fix PPC DMA breakage 2009-05-17 21:16:47 -07:00
mvme147.c
myri_sbus.c myri_sbus: use request_firmware 2009-04-04 16:38:42 -07:00
myri_sbus.h
natsemi.c
ne2.c
ne2k-pci.c ne2k-pci: Do not register device until initialized. 2009-05-02 13:52:13 -07:00
ne3210.c
ne-h8300.c
ne.c
netconsole.c netconsole: take care of NETDEV_UNREGISTER event 2009-05-01 15:24:18 -07:00
netx-eth.c
ni52.c netdev: convert ni52 to net_device_ops 2009-03-27 00:46:53 -07:00
ni52.h
ni65.c netdev: convert ni65 to net_device_ops 2009-03-27 00:46:53 -07:00
ni65.h
ni5010.c ni5010: convert to net_device_ops 2009-03-28 23:37:27 -07:00
ni5010.h
niu.c niu: Fix unused variable warning. 2009-04-08 15:52:16 -07:00
niu.h
ns83820.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
pasemi_mac_ethtool.c
pasemi_mac.c
pasemi_mac.h
pci-skeleton.c
pcnet32.c
plip.c
ppp_async.c ppp: ppp_mp_explode() redesign 2009-03-13 16:09:12 -07:00
ppp_deflate.c
ppp_generic.c ppp: ppp_mp_explode() redesign 2009-03-13 16:09:12 -07:00
ppp_mppe.c
ppp_mppe.h
ppp_synctty.c ppp: ppp_mp_explode() redesign 2009-03-13 16:09:12 -07:00
pppoe.c net: convert usage of packet_type to read_mostly 2009-03-10 05:22:43 -07:00
pppol2tp.c
pppox.c
ps3_gelic_net.c
ps3_gelic_net.h
ps3_gelic_wireless.c net/ps3: Fix wireless AP connect error handling 2009-04-16 10:39:06 -04:00
ps3_gelic_wireless.h
qla3xxx.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
qla3xxx.h
r6040.c r6040: set MODULE_VERSION 2009-04-08 15:50:43 -07:00
r8169.c r8169: fix crash when large packets are received 2009-06-09 04:01:02 -07:00
rionet.c
rrunner.c
rrunner.h
s2io-regs.h
s2io.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
s2io.h
sb1000.c
sb1250-mac.c trivial: Fix misspelling of firmware 2009-03-30 15:21:59 +02:00
sc92031.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
seeq8005.c netdev: seeq8005 convert to net_device_ops 2009-03-27 00:46:46 -07:00
seeq8005.h
sgiseeq.c
sgiseeq.h
sh_eth.c sh_eth: convert to net_device_ops 2009-04-13 15:16:25 -07:00
sh_eth.h sh_eth: Fix mistake of the address of SH7763 2009-03-18 23:31:50 -07:00
sis190.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sis900.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sis900.h
skge.c skge: fix occasional BUG during MTU change 2009-04-14 15:16:55 -07:00
skge.h
sky2.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sky2.h
slhc.c
slip.c
slip.h
smc91x.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
smc91x.h Separate out the proc- and unit-specific header directories from the general 2009-04-10 14:33:48 +01:00
smc911x.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
smc911x.h Merge branch 'for-rmk' of git://git.pengutronix.de/git/imx/linux-2.6 into devel 2009-03-13 21:44:51 +00:00
smc9194.c netdev: smc9194 convert to net_device_ops 2009-03-27 00:46:47 -07:00
smc9194.h
smc-mca.c
smc-ultra32.c netdev: smc-ultra32 convert to net_device_ops 2009-03-27 00:46:47 -07:00
smc-ultra.c netdev: smc-ultra fix netpoll 2009-03-27 00:46:48 -07:00
smsc911x.c smsc911x: correct debugging message on mii read timeout 2009-04-08 15:42:15 -07:00
smsc911x.h smsc911x: define status word positions as constants 2009-03-19 23:59:27 -07:00
smsc9420.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
smsc9420.h
sni_82596.c
sonic.c
sonic.h
Space.c
spider_net_ethtool.c
spider_net.c spider_net: Add missing .ndo_validate_addr 2009-03-23 14:42:09 -07:00
spider_net.h
starfire.c
stnic.c
sun3_82586.c sun3_82586: convert to net_device_ops 2009-04-13 15:16:24 -07:00
sun3_82586.h
sun3lance.c
sunbmac.c myri_sbus/sunbmac/sunlance/sunqe: Add missing net_device_ops entries. 2009-03-23 14:29:24 -07:00
sunbmac.h
sundance.c
sungem_phy.c
sungem_phy.h
sungem.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sungem.h
sunhme.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 2009-03-12 09:27:53 -07:00
sunhme.h
sunlance.c myri_sbus/sunbmac/sunlance/sunqe: Add missing net_device_ops entries. 2009-03-23 14:29:24 -07:00
sunqe.c myri_sbus/sunbmac/sunlance/sunqe: Add missing net_device_ops entries. 2009-03-23 14:29:24 -07:00
sunqe.h
sunvnet.c sunvnet: Convert to net_device_ops. 2009-03-20 00:51:22 -07:00
sunvnet.h
tc35815.c tc35815: convert to net_device_ops 2009-04-13 15:16:23 -07:00
tehuti.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
tehuti.h dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
tg3.c tg3: Fix SEEPROM accesses 2009-04-20 14:52:29 -07:00
tg3.h
tlan.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
tlan.h
tsi108_eth.c tsi108_eth: convert to net_device_ops 2009-04-13 15:16:21 -07:00
tsi108_eth.h
tun.c tun: Fix sk_sleep races when attaching/detaching 2009-04-20 03:01:48 -07:00
typhoon.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
typhoon.h
ucc_geth_ethtool.c ucc_geth: Remove unused header 2009-04-02 01:13:48 -07:00
ucc_geth.c ucc_geth.c: Fix upsmr setting in RMII mode 2009-04-22 00:46:08 -07:00
ucc_geth.h ucc_geth: Pass proper device to DMA routines, otherwise oops happens 2009-04-02 01:26:07 -07:00
veth.c veth: prevent oops caused by netdev destructor 2009-04-27 03:04:58 -07:00
via-rhine.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
via-velocity.c via-velocity : fix compilation warning. 2009-04-11 01:52:38 -07:00
via-velocity.h
virtio_net.c virtio_net: Fix function name typo 2009-05-01 21:26:36 -07:00
wd.c
xen-netfront.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2009-03-28 13:30:43 -07:00
xtsonic.c xtsonic: convert to net_device_ops 2009-04-13 15:16:21 -07:00
yellowfin.c
znet.c
zorro8390.c