linux-kernelorg-stable/drivers/net
Eric Dumazet fdd7b4c330 r8169: fix crash when large packets are received
Michael Tokarev reported receiving a large packet could crash
a machine with RTL8169 NIC.
( original thread at http://lkml.org/lkml/2009/6/8/192 )

Problem is this driver tells that NIC frames up to 16383 bytes
can be received but provides skb to rx ring allocated with
smaller sizes (1536 bytes in case standard 1500 bytes MTU is used)

When a frame larger than what was allocated by driver is received,
dma transfert can occurs past the end of buffer and corrupt
kernel memory.

Fix is to tell to NIC what is the maximum size a frame can be.

This bug is very old, (before git introduction, linux-2.6.10), and 
should be backported to stable versions.

Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-09 04:01:02 -07:00
..
appletalk
arcnet
arm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2009-05-10 10:46:45 -07:00
atl1c
atl1e ath1e: add new device id for asus hardware 2009-05-29 22:04:54 -07:00
atlx atlx: move modinfo data from atlx.h to atl1.c 2009-05-26 20:50:12 -07:00
benet be2net: add two new pci device ids to pci device table 2009-05-18 15:38:55 -07:00
bonding bonding: fix link down handling in 802.3ad mode 2009-05-17 21:15:54 -07:00
can
chelsio
cris
cxgb3 cxgb3: link fault fixes 2009-05-29 01:54:41 -07:00
e1000 e1000: add missing length check to e1000 receive routine 2009-06-02 01:29:58 -07:00
e1000e
ehea
enic
fs_enet
hamradio
ibm_newemac
igb
igbvf
irda
ixgb
ixgbe
ixp2000
mlx4 mlx4_en: Fix a kernel panic when waking tx queue 2009-05-29 22:04:42 -07:00
myri10ge
netxen
pcmcia
phy
qlge
sfc
skfp
tokenring
tulip
usb
vxge Neterion: *FIFO1_DMA_ERR set twice, should 2nd be *FIFO2_DMA_ERR? 2009-05-17 21:18:05 -07:00
wan
wimax wimax/i2400m: usb: fix device reset on autosuspend while not yet idle 2009-05-22 00:13:18 -07:00
wireless rtl8187: add USB ID for Linksys WUSB54GC-EU v2 USB wifi dongle 2009-05-29 12:41:01 +02:00
3c59x.c
3c501.c
3c501.h
3c503.c
3c503.h
3c505.c
3c505.h
3c507.c
3c509.c 3c509: Add missing EISA IDs 2009-06-01 03:12:04 -07:00
3c515.c
3c523.c
3c523.h
3c527.c
3c527.h
7990.c
7990.h
8139cp.c
8139too.c
8390.c
8390.h
8390p.c
82596.c
Kconfig
LICENSE.SRC
Makefile mac8390: fix regression caused during net_device_ops conversion 2009-05-25 22:43:49 -07:00
Space.c
a2065.c
a2065.h
ac3200.c
acenic.c
acenic.h
amd8111e.c
amd8111e.h
apne.c
ariadne.c
ariadne.h
at1700.c
atarilance.c
atp.c
atp.h
au1000_eth.c
au1000_eth.h
ax88796.c
b44.c
b44.h
bfin_mac.c bfin_mac: fix build error due to net_device_ops convert 2009-05-26 20:55:33 -07:00
bfin_mac.h
bmac.c
bmac.h
bnx2.c
bnx2.h
bnx2_fw.h
bnx2x.h
bnx2x_dump.h
bnx2x_fw_defs.h
bnx2x_hsi.h
bnx2x_init.h
bnx2x_init_values.h
bnx2x_link.c
bnx2x_link.h
bnx2x_main.c
bnx2x_reg.h
bsd_comp.c
cassini.c
cassini.h
cpmac.c
cs89x0.c
cs89x0.h
de600.c
de600.h
de620.c
de620.h
declance.c
defxx.c
defxx.h
depca.c
depca.h
dl2k.c
dl2k.h
dm9000.c
dm9000.h
dnet.c
dnet.h
dummy.c
e100.c
e2100.c
eepro.c
eexpress.c
eexpress.h
enc28j60.c
enc28j60_hw.h
epic100.c
eql.c
es3210.c
eth16i.c
ethoc.c
ewrk3.c
ewrk3.h
fealnx.c
fec.c
fec.h
fec_mpc52xx.c
fec_mpc52xx.h
fec_mpc52xx_phy.c
forcedeth.c forcedeth: add phy_power_down parameter, leave phy powered up by default (v2) 2009-06-02 00:19:52 -07:00
fsl_pq_mdio.c
fsl_pq_mdio.h
gianfar.c gianfar: fix BUG under load after introduction of skb recycling 2009-05-25 00:42:34 -07:00
gianfar.h gianfar: fix babbling rx error event bug 2009-05-26 20:48:04 -07:00
gianfar_ethtool.c
gianfar_sysfs.c
hamachi.c
hp-plus.c
hp.c
hp100.c
hp100.h
hplance.c
hplance.h
hydra.c
ibmlana.c
ibmlana.h
ibmveth.c
ibmveth.h
ifb.c
ioc3-eth.c
ipg.c
ipg.h
isa-skeleton.c
iseries_veth.c
jazzsonic.c
jme.c
jme.h
korina.c
lance.c
lasi_82596.c
lib8390.c
lib82596.c
lne390.c
loopback.c
lp486e.c
mac89x0.c
mac8390.c mac8390: fix build with NET_POLL_CONTROLLER 2009-05-29 01:56:35 -07:00
macb.c
macb.h
mace.c
mace.h
macmace.c
macsonic.c
macvlan.c
meth.c NET: Meth: Fix unsafe mix of irq and non-irq spinlocks. 2009-05-17 21:11:36 -07:00
meth.h
mii.c
mipsnet.c
mv643xx_eth.c mv643xx_eth: fix PPC DMA breakage 2009-05-17 21:16:47 -07:00
mvme147.c
myri_sbus.c
myri_sbus.h
natsemi.c
ne-h8300.c
ne.c
ne2.c
ne2k-pci.c
ne3210.c
netconsole.c
netx-eth.c
ni52.c
ni52.h
ni65.c
ni65.h
ni5010.c
ni5010.h
niu.c
niu.h
ns83820.c
pasemi_mac.c
pasemi_mac.h
pasemi_mac_ethtool.c
pci-skeleton.c
pcnet32.c
plip.c
ppp_async.c
ppp_deflate.c
ppp_generic.c
ppp_mppe.c
ppp_mppe.h
ppp_synctty.c
pppoe.c
pppol2tp.c
pppox.c
ps3_gelic_net.c
ps3_gelic_net.h
ps3_gelic_wireless.c
ps3_gelic_wireless.h
qla3xxx.c
qla3xxx.h
r6040.c
r8169.c r8169: fix crash when large packets are received 2009-06-09 04:01:02 -07:00
rionet.c
rrunner.c
rrunner.h
s2io-regs.h
s2io.c
s2io.h
sb1000.c
sb1250-mac.c
sc92031.c
seeq8005.c
seeq8005.h
sgiseeq.c
sgiseeq.h
sh_eth.c
sh_eth.h
sis190.c
sis900.c
sis900.h
skge.c
skge.h
sky2.c
sky2.h
slhc.c
slip.c
slip.h
smc-mca.c
smc-ultra.c
smc-ultra32.c
smc91x.c
smc91x.h
smc911x.c
smc911x.h
smc9194.c
smc9194.h
smsc911x.c
smsc911x.h
smsc9420.c
smsc9420.h
sni_82596.c
sonic.c
sonic.h
spider_net.c
spider_net.h
spider_net_ethtool.c
starfire.c
stnic.c
sun3_82586.c
sun3_82586.h
sun3lance.c
sunbmac.c
sunbmac.h
sundance.c
sungem.c
sungem.h
sungem_phy.c
sungem_phy.h
sunhme.c
sunhme.h
sunlance.c
sunqe.c
sunqe.h
sunvnet.c
sunvnet.h
tc35815.c
tehuti.c
tehuti.h
tg3.c
tg3.h
tlan.c
tlan.h
tsi108_eth.c
tsi108_eth.h
tun.c
typhoon.c
typhoon.h
ucc_geth.c
ucc_geth.h
ucc_geth_ethtool.c
veth.c
via-rhine.c
via-velocity.c
via-velocity.h
virtio_net.c
wd.c
xen-netfront.c
xtsonic.c
yellowfin.c
znet.c
zorro8390.c