linux-toradex.git/net/packet, branch v3.18-rc5

net: Pass a "more" indication down into netdev_start_xmit() code paths.

2014-09-02T00:39:55+00:00

For now it will always be false.

Signed-off-by: David S. Miller

net: Do txq_trans_update() in netdev_start_xmit()

2014-09-02T00:39:55+00:00

That way we don't have to audit every call site to make sure it is
doing this properly.

Signed-off-by: David S. Miller

net: add skb_get_tx_queue() helper

2014-08-30T03:02:07+00:00

Replace occurences of skb_get_queue_mapping() and follow-up
netdev_get_tx_queue() with an actual helper function.

Signed-off-by: Daniel Borkmann 
Signed-off-by: David S. Miller

net: Add ops->ndo_xmit_flush()

2014-08-25T06:02:45+00:00

Signed-off-by: David S. Miller

packet: handle too big packets for PACKET_V3

2014-08-21T23:44:28+00:00

af_packet can currently overwrite kernel memory by out of bound
accesses, because it assumed a [new] block can always hold one frame.

This is not generally the case, even if most existing tools do it right.

This patch clamps too long frames as API permits, and issue a one time
error on syslog.

[  394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82

In this example, packet header tp_snaplen was set to 3966,
and tp_len was set to 5042 (skb->len)

Signed-off-by: Eric Dumazet 
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Acked-by: Daniel Borkmann 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller

packet: remove deprecated syststamp timestamp

2014-07-29T18:39:50+00:00

No device driver will ever return an skb_shared_info structure with
syststamp non-zero, so remove the branch that tests for this and
optionally marks the packet timestamp as TP_STATUS_TS_SYS_HARDWARE.

Do not remove the definition TP_STATUS_TS_SYS_HARDWARE, as processes
may refer to it.

Signed-off-by: Willem de Bruijn 
Signed-off-by: David S. Miller

packet: remove unnecessary break after return

2014-07-15T23:26:59+00:00

Signed-off-by: Fabian Frederick 
Signed-off-by: David S. Miller

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24T17:44:54+00:00

It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.

To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.

Reported-by: Andy Lutomirski 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump

2014-04-24T17:44:53+00:00

The permission check in sock_diag_put_filterinfo is wrong, and it is so removed
from it's sources it is not clear why it is wrong.  Move the computation
into packet_diag_dump and pass a bool of the result into sock_diag_filterinfo.

This does not yet correct the capability check but instead simply moves it to make
it clear what is going on.

Reported-by: Andy Lutomirski 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: David S. Miller

net: Fix ns_capable check in sock_diag_put_filterinfo

2014-04-22T16:49:39+00:00

The caller needs capabilities on the namespace being queried, not on
their own namespace.  This is a security bug, although it likely has
only a minor impact.

Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski 
Acked-by: Nicolas Dichtel 
Signed-off-by: David S. Miller