mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-11-01 08:58:07 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/8021q
History
Sabrina Dubroca fcd91dd449 net: add recursion limit to GRO 
Currently, GRO can do unlimited recursion through the gro_receive
handlers.  This was fixed for tunneling protocols by limiting tunnel GRO
to one level with encap_mark, but both VLAN and TEB still have this
problem.  Thus, the kernel is vulnerable to a stack overflow, if we
receive a packet composed entirely of VLAN headers.

This patch adds a recursion counter to the GRO layer to prevent stack
overflow.  When a gro_receive function hits the recursion limit, GRO is
aborted for this skb and it is processed normally.  This recursion
counter is put in the GRO CB, but could be turned into a percpu counter
if we run out of space in the CB.

Thanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report.

Fixes: CVE-2016-7039
Fixes: 9b174d88c2 ("net: Add Transparent Ethernet Bridging GRO support.")
Fixes: 66e5133f19 ("vlan: Add GRO support for non hardware accelerated vlan")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Jiri Benc <jbenc@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-10-20 14:32:22 -04:00
..
Kconfig 8021q: update description 2014-01-21 17:01:25 -08:00
Makefile net/8021q: Implement Multiple VLAN Registration Protocol (MVRP) 2013-02-10 20:37:22 -05:00
vlan.c net: add recursion limit to GRO 2016-10-20 14:32:22 -04:00
vlan.h vlan: Propagate MAC address to VLANs 2016-05-31 11:56:48 -07:00
vlan_core.c vlan: Do not put vlan headers back on bridge and macvlan ports 2015-11-17 14:38:35 -05:00
vlan_dev.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-07-24 00:53:32 -04:00
vlan_gvrp.c net: vlan: prepare for 802.1ad support 2013-04-19 14:45:27 -04:00
vlan_mvrp.c net: vlan: prepare for 802.1ad support 2013-04-19 14:45:27 -04:00
vlan_netlink.c vlan: use a valid default mtu value for vlan over macsec 2016-07-16 20:15:02 -07:00
vlanproc.c vlan: change return type of vlan_proc_rem_dev 2016-02-17 22:06:28 -05:00
vlanproc.h vlan: change return type of vlan_proc_rem_dev 2016-02-17 22:06:28 -05:00