summaryrefslogtreecommitdiffstats
path: root/net/8021q
diff options
context:
space:
mode:
authorSabrina Dubroca <sd@queasysnail.net>2016-10-20 15:58:02 +0200
committerDavid S. Miller <davem@davemloft.net>2016-10-20 14:32:22 -0400
commitfcd91dd449867c6bfe56a81cabba76b829fd05cd (patch)
tree5bf8afb23894d48dda7ba09bdf4ab12935d81159 /net/8021q
parent7aa8e63f0d0f2e0ae353632bca1ce75a258696c6 (diff)
downloadlinux-fcd91dd449867c6bfe56a81cabba76b829fd05cd.tar.gz
linux-fcd91dd449867c6bfe56a81cabba76b829fd05cd.tar.bz2
linux-fcd91dd449867c6bfe56a81cabba76b829fd05cd.zip
net: add recursion limit to GRO
Currently, GRO can do unlimited recursion through the gro_receive handlers. This was fixed for tunneling protocols by limiting tunnel GRO to one level with encap_mark, but both VLAN and TEB still have this problem. Thus, the kernel is vulnerable to a stack overflow, if we receive a packet composed entirely of VLAN headers. This patch adds a recursion counter to the GRO layer to prevent stack overflow. When a gro_receive function hits the recursion limit, GRO is aborted for this skb and it is processed normally. This recursion counter is put in the GRO CB, but could be turned into a percpu counter if we run out of space in the CB. Thanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report. Fixes: CVE-2016-7039 Fixes: 9b174d88c257 ("net: Add Transparent Ethernet Bridging GRO support.") Fixes: 66e5133f19e9 ("vlan: Add GRO support for non hardware accelerated vlan") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Jiri Benc <jbenc@redhat.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Acked-by: Tom Herbert <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/8021q')
-rw-r--r--net/8021q/vlan.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 8de138d3306b..f2531ad66b68 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -664,7 +664,7 @@ static struct sk_buff **vlan_gro_receive(struct sk_buff **head,
skb_gro_pull(skb, sizeof(*vhdr));
skb_gro_postpull_rcsum(skb, vhdr, sizeof(*vhdr));
- pp = ptype->callbacks.gro_receive(head, skb);
+ pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
out_unlock:
rcu_read_unlock();