q3k/linux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
linux/drivers/net
History
Neil Horman ea30e11970 e1000: add missing length check to e1000 receive routine 
Patch to fix bad length checking in e1000.  E1000 by default does two
things:

1) Spans rx descriptors for packets that don't fit into 1 skb on recieve
2) Strips the crc from a frame by subtracting 4 bytes from the length prior to
doing an skb_put

Since the e1000 driver isn't written to support receiving packets that span
multiple rx buffers, it checks the End of Packet bit of every frame, and
discards it if its not set.  This places us in a situation where, if we have a
spanning packet, the first part is discarded, but the second part is not (since
it is the end of packet, and it passes the EOP bit test).  If the second part of
the frame is small (4 bytes or less), we subtract 4 from it to remove its crc,
underflow the length, and wind up in skb_over_panic, when we try to skb_put a
huge number of bytes into the skb.  This amounts to a remote DOS attack through
careful selection of frame size in relation to interface MTU.  The fix for this
is already in the e1000e driver, as well as the e1000 sourceforge driver, but no
one ever pushed it to e1000.  This is lifted straight from e1000e, and prevents
small frames from causing the underflow described above

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Tested-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-02 01:29:58 -07:00
..
appletalk appletalk: convert LTPC to net_device_ops 2009-03-27 00:46:42 -07:00
arcnet
arm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-05-10 10:46:45 -07:00
atl1c Replace all DMA_nBIT_MASK macro with DMA_BIT_MASK(n) 2009-04-13 15:04:33 -07:00
atl1e ath1e: add new device id for asus hardware 2009-05-29 22:04:54 -07:00
atlx atlx: move modinfo data from atlx.h to atl1.c 2009-05-26 20:50:12 -07:00
benet be2net: add two new pci device ids to pci device table 2009-05-18 15:38:55 -07:00
bonding bonding: fix link down handling in 802.3ad mode 2009-05-17 21:15:54 -07:00
can
chelsio dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
cris eth_v10: convert to net_device_ops 2009-04-13 15:16:33 -07:00
cxgb3 cxgb3: link fault fixes 2009-05-29 01:54:41 -07:00
e1000 e1000: add missing length check to e1000 receive routine 2009-06-02 01:29:58 -07:00
e1000e e1000e: fix bug in restart queue logic 2009-04-17 01:09:58 -07:00
ehea ehea: fix invalid pointer access 2009-05-04 11:06:37 -07:00
enic dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
fs_enet fs_enet: convert to netdev_ops 2009-04-11 02:06:43 -07:00
hamradio Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jaswinder/net-next-2.6 2009-03-31 14:43:54 -07:00
ibm_newemac ibm_newemac: convert to netdev_ops 2009-04-11 02:06:45 -07:00
igb igb: resolve panic on shutdown when SR-IOV is enabled 2009-05-06 16:43:48 -07:00
igbvf igbvf: fix unused external references 2009-04-11 02:55:14 -07:00
irda proc 2/2: remove struct proc_dir_entry::owner 2009-03-31 01:14:44 +04:00
ixgb dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
ixgbe ixgbe: Fix WoL functionality for 82599 KX4 devices 2009-04-27 03:14:48 -07:00
ixp2000
mlx4 mlx4_en: Fix a kernel panic when waking tx queue 2009-05-29 22:04:42 -07:00
myri10ge myr10ge: again fix lro_gen_skb() alignment 2009-04-15 02:29:33 -07:00
netxen dma-mapping: replace all DMA_39BIT_MASK macro with DMA_BIT_MASK(39) 2009-04-07 08:31:11 -07:00
pcmcia pcnet_cs: add cis(firmware) of the Allied Telesis LA-PCM 2009-04-21 02:06:14 -07:00
phy phylib: Fix delay argument of schedule_delayed_work 2009-04-16 03:13:07 -07:00
qlge dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sfc sfc: Use correct macro to set event bitfield 2009-04-14 19:48:34 -07:00
skfp trivial: fix typo "varaible" -> "variable" 2009-03-30 15:21:57 +02:00
tokenring dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
tulip dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
usb usbnet: CDC EEM support (v5) 2009-05-04 12:01:43 -07:00
vxge Neterion: *FIFO1_DMA_ERR set twice, should 2nd be *FIFO2_DMA_ERR? 2009-05-17 21:18:05 -07:00
wan IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization. 2009-05-09 14:55:52 +02:00
wimax wimax/i2400m: usb: fix device reset on autosuspend while not yet idle 2009-05-22 00:13:18 -07:00
wireless rtl8187: add USB ID for Linksys WUSB54GC-EU v2 USB wifi dongle 2009-05-29 12:41:01 +02:00
3c59x.c
3c501.c
3c501.h
3c503.c 3c503, smc-ultra: netdev_ops bugs 2009-03-27 00:46:38 -07:00
3c503.h
3c505.c
3c505.h
3c507.c
3c509.c 3c509: Add missing EISA IDs 2009-06-01 03:12:04 -07:00
3c515.c
3c523.c
3c523.h
3c527.c
3c527.h
7990.c
7990.h
8139cp.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
8139too.c 8139too: fix HW initial flow 2009-04-22 00:43:24 -07:00
8390.c
8390.h
8390p.c
82596.c
a2065.c a2065: convert to net_device_ops 2009-04-14 21:57:00 -07:00
a2065.h
ac3200.c netdev: convert ac3200 to net_device_ops 2009-03-27 00:46:54 -07:00
acenic.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
acenic.h
amd8111e.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
amd8111e.h
apne.c
ariadne.c ariadne: convert to net_device_ops 2009-04-11 02:53:46 -07:00
ariadne.h
at1700.c netdev: convert at1700 to net_device_ops 2009-03-27 00:46:51 -07:00
atarilance.c atarilance: convert to net_device_ops 2009-04-14 21:57:01 -07:00
atp.c
atp.h
au1000_eth.c au1000: convert to net_device_ops 2009-04-14 21:57:02 -07:00
au1000_eth.h
ax88796.c ax88796: Add method to take MAC from platform data 2009-03-24 23:32:03 -07:00
b44.c dma-mapping: replace all DMA_30BIT_MASK macro with DMA_BIT_MASK(30) 2009-04-07 08:31:11 -07:00
b44.h
bfin_mac.c bfin_mac: fix build error due to net_device_ops convert 2009-05-26 20:55:33 -07:00
bfin_mac.h
bmac.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
bmac.h
bnx2.c bnx2: Fix panic in bnx2_poll_work(). 2009-05-06 16:46:47 -07:00
bnx2.h bnx2: Use request_firmware() 2009-04-04 16:51:14 -07:00
bnx2_fw.h bnx2: Use request_firmware() 2009-04-04 16:51:14 -07:00
bnx2x.h Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2009-03-10 05:04:16 -07:00
bnx2x_dump.h bnx2x: Register dump 2009-03-02 22:32:48 -08:00
bnx2x_fw_defs.h
bnx2x_hsi.h
bnx2x_init.h bnx2x: Using DMAE to initialize the chip 2009-03-10 04:52:03 -07:00
bnx2x_init_values.h bnx2x: Adding licensing to bnx2x_init_values.h 2009-03-22 21:24:19 -07:00
bnx2x_link.c bnx2x: Loopback support at external PHY 2009-03-02 22:32:45 -08:00
bnx2x_link.h
bnx2x_main.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
bnx2x_reg.h bnx2x: Supporting new BCM8726 FW 2009-03-02 22:32:43 -08:00
bsd_comp.c
cassini.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
cassini.h
cpmac.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
cs89x0.c netdev: convert cs89x0 to net_device_ops 2009-03-27 00:46:55 -07:00
cs89x0.h
de600.c
de600.h
de620.c
de620.h
declance.c declance: convert to net_device_ops 2009-04-14 21:57:04 -07:00
defxx.c
defxx.h
depca.c netdev: convert depca to net_device_ops 2009-03-27 00:46:52 -07:00
depca.h
dl2k.c dma-mapping: replace all DMA_48BIT_MASK macro with DMA_BIT_MASK(48) 2009-04-07 08:31:10 -07:00
dl2k.h
dm9000.c workqueue: add to_delayed_work() helper function 2009-04-02 19:04:50 -07:00
dm9000.h
dnet.c dnet: remove unused #include <version.h> 2009-04-02 16:31:45 -07:00
dnet.h dnet: Dave DNET ethernet controller driver (updated) 2009-03-11 23:26:02 -07:00
dummy.c
e100.c e100: do not go D3 in shutdown unless system is powering off 2009-04-28 22:42:39 -07:00
e2100.c
eepro.c netdev: convert eexpro to net_device_ops 2009-03-27 00:46:51 -07:00
eexpress.c netdev: convert eexpress to net_device_ops 2009-03-27 00:46:50 -07:00
eexpress.h
enc28j60.c
enc28j60_hw.h
epic100.c
eql.c drivers/net/eql.c: Fix a dev leakage. 2009-04-08 15:56:33 -07:00
es3210.c
eth16i.c netdev: convert eth16i to net_device_ops 2009-03-27 00:46:55 -07:00
ethoc.c net: Add support for the OpenCores 10/100 Mbps Ethernet MAC. 2009-03-27 00:16:21 -07:00
ewrk3.c netdev: convert ewrk3 to net_device_ops 2009-03-27 00:46:52 -07:00
ewrk3.h
fealnx.c
fec.c FEC driver: add missing #endif 2009-04-08 15:44:45 -07:00
fec.h
fec_mpc52xx.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-04-02 21:05:30 -07:00
fec_mpc52xx.h
fec_mpc52xx_phy.c
forcedeth.c forcedeth: add phy_power_down parameter, leave phy powered up by default (v2) 2009-06-02 00:19:52 -07:00
fsl_pq_mdio.c fsl_pq_mdio: Fix compile failure 2009-04-02 13:57:30 -07:00
fsl_pq_mdio.h
gianfar.c gianfar: fix BUG under load after introduction of skb recycling 2009-05-25 00:42:34 -07:00
gianfar.h gianfar: fix babbling rx error event bug 2009-05-26 20:48:04 -07:00
gianfar_ethtool.c
gianfar_sysfs.c
hamachi.c
hp-plus.c
hp.c
hp100.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
hp100.h
hplance.c
hplance.h
hydra.c
ibmlana.c netdev: ibmlana convert to net_device_ops 2009-03-27 00:46:49 -07:00
ibmlana.h
ibmveth.c
ibmveth.h
ifb.c
ioc3-eth.c ioc3-eth: convert to net_device_ops 2009-04-13 15:16:31 -07:00
ipg.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
ipg.h
isa-skeleton.c isa-skeleton: convert to net_device_ops 2009-04-13 15:16:30 -07:00
iseries_veth.c
jazzsonic.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
jme.c Replace all DMA_nBIT_MASK macro with DMA_BIT_MASK(n) 2009-04-13 15:04:33 -07:00
jme.h jme: Advance version number after previous changes 2009-03-02 01:55:15 -08:00
Kconfig net: fix "compatibility" typos 2009-04-20 02:15:01 -07:00
korina.c
lance.c lance: convert to net_device_ops 2009-03-27 00:46:48 -07:00
lasi_82596.c
lib8390.c
lib82596.c
LICENSE.SRC
lne390.c
loopback.c
lp486e.c netdev: convert lp486e to net_device_ops 2009-03-27 00:46:54 -07:00
mac89x0.c mac89x0: convert to net_device_ops 2009-04-13 15:16:29 -07:00
mac8390.c mac8390: fix build with NET_POLL_CONTROLLER 2009-05-29 01:56:35 -07:00
macb.c macb: process the RX ring regardless of interrupt status 2009-04-17 01:30:34 -07:00
macb.h
mace.c
mace.h
macmace.c
macsonic.c macsonic: convert to net_device_ops 2009-04-13 15:16:26 -07:00
macvlan.c vlan/macvlan: fix NULL pointer dereferences in ethtool handlers 2009-04-17 15:59:23 -07:00
Makefile mac8390: fix regression caused during net_device_ops conversion 2009-05-25 22:43:49 -07:00
meth.c NET: Meth: Fix unsafe mix of irq and non-irq spinlocks. 2009-05-17 21:11:36 -07:00
meth.h
mii.c
mipsnet.c platform driver: fix incorrect use of 'platform_bus_type' with 'struct device_driver' 2009-03-24 16:38:25 -07:00
mv643xx_eth.c mv643xx_eth: fix PPC DMA breakage 2009-05-17 21:16:47 -07:00
mvme147.c
myri_sbus.c myri_sbus: use request_firmware 2009-04-04 16:38:42 -07:00
myri_sbus.h
natsemi.c
ne-h8300.c
ne.c
ne2.c
ne2k-pci.c ne2k-pci: Do not register device until initialized. 2009-05-02 13:52:13 -07:00
ne3210.c
netconsole.c netconsole: take care of NETDEV_UNREGISTER event 2009-05-01 15:24:18 -07:00
netx-eth.c
ni52.c netdev: convert ni52 to net_device_ops 2009-03-27 00:46:53 -07:00
ni52.h
ni65.c netdev: convert ni65 to net_device_ops 2009-03-27 00:46:53 -07:00
ni65.h
ni5010.c ni5010: convert to net_device_ops 2009-03-28 23:37:27 -07:00
ni5010.h
niu.c niu: Fix unused variable warning. 2009-04-08 15:52:16 -07:00
niu.h
ns83820.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
pasemi_mac.c
pasemi_mac.h
pasemi_mac_ethtool.c
pci-skeleton.c
pcnet32.c
plip.c
ppp_async.c ppp: ppp_mp_explode() redesign 2009-03-13 16:09:12 -07:00
ppp_deflate.c
ppp_generic.c ppp: ppp_mp_explode() redesign 2009-03-13 16:09:12 -07:00
ppp_mppe.c
ppp_mppe.h
ppp_synctty.c ppp: ppp_mp_explode() redesign 2009-03-13 16:09:12 -07:00
pppoe.c net: convert usage of packet_type to read_mostly 2009-03-10 05:22:43 -07:00
pppol2tp.c
pppox.c
ps3_gelic_net.c
ps3_gelic_net.h
ps3_gelic_wireless.c net/ps3: Fix wireless AP connect error handling 2009-04-16 10:39:06 -04:00
ps3_gelic_wireless.h
qla3xxx.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
qla3xxx.h
r6040.c r6040: set MODULE_VERSION 2009-04-08 15:50:43 -07:00
r8169.c r8169: avoid losing MSI interrupts 2009-05-25 22:55:26 -07:00
rionet.c
rrunner.c
rrunner.h
s2io-regs.h
s2io.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
s2io.h
sb1000.c
sb1250-mac.c trivial: Fix misspelling of firmware 2009-03-30 15:21:59 +02:00
sc92031.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
seeq8005.c netdev: seeq8005 convert to net_device_ops 2009-03-27 00:46:46 -07:00
seeq8005.h
sgiseeq.c
sgiseeq.h
sh_eth.c sh_eth: convert to net_device_ops 2009-04-13 15:16:25 -07:00
sh_eth.h sh_eth: Fix mistake of the address of SH7763 2009-03-18 23:31:50 -07:00
sis190.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sis900.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sis900.h
skge.c skge: fix occasional BUG during MTU change 2009-04-14 15:16:55 -07:00
skge.h
sky2.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sky2.h
slhc.c
slip.c
slip.h
smc-mca.c
smc-ultra.c netdev: smc-ultra fix netpoll 2009-03-27 00:46:48 -07:00
smc-ultra32.c netdev: smc-ultra32 convert to net_device_ops 2009-03-27 00:46:47 -07:00
smc91x.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
smc91x.h Separate out the proc- and unit-specific header directories from the general 2009-04-10 14:33:48 +01:00
smc911x.c net: struct device - replace bus_id with dev_name(), dev_set_name() 2009-03-24 16:38:22 -07:00
smc911x.h Merge branch 'for-rmk' of git://git.pengutronix.de/git/imx/linux-2.6 into devel 2009-03-13 21:44:51 +00:00
smc9194.c netdev: smc9194 convert to net_device_ops 2009-03-27 00:46:47 -07:00
smc9194.h
smsc911x.c smsc911x: correct debugging message on mii read timeout 2009-04-08 15:42:15 -07:00
smsc911x.h smsc911x: define status word positions as constants 2009-03-19 23:59:27 -07:00
smsc9420.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
smsc9420.h
sni_82596.c
sonic.c
sonic.h
Space.c
spider_net.c spider_net: Add missing .ndo_validate_addr 2009-03-23 14:42:09 -07:00
spider_net.h
spider_net_ethtool.c
starfire.c
stnic.c
sun3_82586.c sun3_82586: convert to net_device_ops 2009-04-13 15:16:24 -07:00
sun3_82586.h
sun3lance.c
sunbmac.c myri_sbus/sunbmac/sunlance/sunqe: Add missing net_device_ops entries. 2009-03-23 14:29:24 -07:00
sunbmac.h
sundance.c
sungem.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
sungem.h
sungem_phy.c
sungem_phy.h
sunhme.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 2009-03-12 09:27:53 -07:00
sunhme.h
sunlance.c myri_sbus/sunbmac/sunlance/sunqe: Add missing net_device_ops entries. 2009-03-23 14:29:24 -07:00
sunqe.c myri_sbus/sunbmac/sunlance/sunqe: Add missing net_device_ops entries. 2009-03-23 14:29:24 -07:00
sunqe.h
sunvnet.c sunvnet: Convert to net_device_ops. 2009-03-20 00:51:22 -07:00
sunvnet.h
tc35815.c tc35815: convert to net_device_ops 2009-04-13 15:16:23 -07:00
tehuti.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
tehuti.h dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
tg3.c tg3: Fix SEEPROM accesses 2009-04-20 14:52:29 -07:00
tg3.h
tlan.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
tlan.h
tsi108_eth.c tsi108_eth: convert to net_device_ops 2009-04-13 15:16:21 -07:00
tsi108_eth.h
tun.c tun: Fix sk_sleep races when attaching/detaching 2009-04-20 03:01:48 -07:00
typhoon.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
typhoon.h
ucc_geth.c ucc_geth.c: Fix upsmr setting in RMII mode 2009-04-22 00:46:08 -07:00
ucc_geth.h ucc_geth: Pass proper device to DMA routines, otherwise oops happens 2009-04-02 01:26:07 -07:00
ucc_geth_ethtool.c ucc_geth: Remove unused header 2009-04-02 01:13:48 -07:00
veth.c veth: prevent oops caused by netdev destructor 2009-04-27 03:04:58 -07:00
via-rhine.c dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) 2009-04-07 08:31:11 -07:00
via-velocity.c via-velocity : fix compilation warning. 2009-04-11 01:52:38 -07:00
via-velocity.h
virtio_net.c virtio_net: Fix function name typo 2009-05-01 21:26:36 -07:00
wd.c
xen-netfront.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2009-03-28 13:30:43 -07:00
xtsonic.c xtsonic: convert to net_device_ops 2009-04-13 15:16:21 -07:00
yellowfin.c
znet.c
zorro8390.c