linux-stable-rt/drivers/net
Neil Horman c0cd884af0 r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)
Official patch to fix the r8169 frame length check error.

Based on this initial thread:
http://marc.info/?l=linux-netdev&m=126202972828626&w=1
This is the official patch to fix the frame length problems in the r8169
driver.  As noted in the previous thread, while this patch incurs a performance
hit on the driver, its possible to improve performance dynamically by updating
the mtu and rx_copybreak values at runtime to return performance to what it was
for those NICS which are unaffected by the ideosyncracy (if there are any).

Summary:

    A while back Eric submitted a patch for r8169 in which the proper
allocated frame size was written to RXMaxSize to prevent the NIC from dmaing too
much data.  This was done in commit fdd7b4c330.  A
long time prior to that however, Francois posted
126fa4b9ca, which expiclitly disabled the MaxSize
setting due to the fact that the hardware behaved in odd ways when overlong
frames were received on NIC's supported by this driver.  This was mentioned in a
security conference recently:
http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html

It seems that if we can't enable frame size filtering, then, as Eric correctly
noticed, we can find ourselves DMA-ing too much data to a buffer, causing
corruption.  As a result is seems that we are forced to allocate a frame which
is ready to handle a maximally sized receive.

This obviously has performance issues with it, so to mitigate that issue, this
patch does two things:

1) Raises the copybreak value to the frame allocation size, which should force
appropriately sized packets to get allocated on rx, rather than a full new 16k
buffer.

2) This patch only disables frame filtering initially (i.e., during the NIC
open), changing the MTU results in ring buffer allocation of a size in relation
to the new mtu (along with a warning indicating that this is dangerous).

Because of item (2), individuals who can't cope with the performance hit (or can
otherwise filter frames to prevent the bug), or who have hardware they are sure
is unaffected by this issue, can manually lower the copybreak and reset the mtu
such that performance is restored easily.

Signed-off-by: Neil Horman <nhorman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-03-29 13:16:02 -07:00
..
appletalk
arcnet
arm KS8695: update ksp->next_rx_desc_read at the end of rx loop 2010-03-19 22:43:29 -07:00
atl1c
atl1e
atlx drivers/net: Fix continuation lines 2010-03-27 08:33:22 -07:00
benet benet: Fix compile warnnings in drivers/net/benet/be_ethtool.c 2010-03-27 08:33:20 -07:00
bonding bonding: fix broken multicast with round-robin mode 2010-03-27 16:39:15 -07:00
can can: bfin_can: switch to common Blackfin can header 2010-03-22 20:05:45 -07:00
chelsio Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
cris
cxgb3 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2010-03-13 14:50:18 -08:00
e1000 e1000: do not modify tx_queue_len on link speed change 2010-03-27 08:33:22 -07:00
e1000e e1000e: do not modify tx_queue_len on link speed change 2010-03-26 21:04:54 -07:00
ehea
enic
fs_enet
hamradio
ibm_newemac
igb igb: use correct bits to identify if managability is enabled 2010-03-27 08:33:20 -07:00
igbvf igbvf: do not modify tx_queue_len on link speed change 2010-03-26 21:01:41 -07:00
irda Merge branch 'master' of /home/davem/src/GIT/linux-2.6/ 2010-03-15 16:23:54 -07:00
ixgb
ixgbe ixgbe: Do not run all Diagnostic offline tests when VFs are active 2010-03-27 08:33:21 -07:00
ixgbevf ixgbevf: Fix signed/unsigned int error 2010-03-26 11:56:00 -07:00
ixp2000
mlx4 sysfs: fix sysfs lockdep warning in mlx4 code 2010-03-19 07:12:15 -07:00
myri10ge myri: remove dead code 2010-03-15 16:00:50 -07:00
netxen netxen: update version to 4.0.73 2010-03-26 11:49:22 -07:00
octeon
pcmcia pcnet_cs: add new id 2010-03-27 16:41:28 -07:00
phy
qlcnic qlcnic: remove extra space from board names 2010-03-08 10:45:30 -08:00
qlge Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
sfc Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
skfp Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
stmmac
tokenring Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
tulip tulip: Add missing parens. 2010-03-28 18:56:34 -07:00
usb smsc95xx: Fix tx checksum offload for small packets 2010-03-18 22:18:41 -07:00
vmxnet3
vxge
wan Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
wimax Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
wireless Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2010-03-18 21:18:19 -07:00
3c59x.c
3c501.c
3c501.h
3c503.c
3c503.h
3c505.c
3c505.h
3c507.c
3c509.c
3c515.c
3c523.c
3c523.h
3c527.c
3c527.h
7990.c
7990.h
8139cp.c
8139too.c
8390.c
8390.h
8390p.c
82596.c
Kconfig net: add ColdFire support to the smc91x driver 2010-03-10 07:37:06 -08:00
LICENSE.SRC
Makefile
Space.c
a2065.c
a2065.h
ac3200.c
acenic.c
acenic.h
amd8111e.c
amd8111e.h
apne.c
ariadne.c
ariadne.h
at1700.c
atarilance.c
atp.c
atp.h
au1000_eth.c
au1000_eth.h
ax88796.c
b44.c
b44.h
bcm63xx_enet.c
bcm63xx_enet.h
bfin_mac.c
bfin_mac.h
bmac.c
bmac.h
bnx2.c bnx2: Use proper handler during netpoll. 2010-03-23 23:19:56 -07:00
bnx2.h
bnx2_fw.h
bnx2x.h
bnx2x_dump.h
bnx2x_fw_defs.h
bnx2x_fw_file_hdr.h
bnx2x_hsi.h
bnx2x_init.h
bnx2x_init_ops.h
bnx2x_link.c
bnx2x_link.h
bnx2x_main.c bnx2x: change smp_mb() comment to conform the true 2010-03-15 15:47:01 -07:00
bnx2x_reg.h
bsd_comp.c
cassini.c
cassini.h
cnic.c
cnic.h
cnic_defs.h
cnic_if.h
cpmac.c
cs89x0.c Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
cs89x0.h
davinci_emac.c Merge branch 'master' of /home/davem/src/GIT/linux-2.6/ 2010-03-15 16:23:54 -07:00
de600.c
de600.h
de620.c
de620.h
declance.c
defxx.c
defxx.h
depca.c
depca.h
dl2k.c
dl2k.h
dm9000.c
dm9000.h
dnet.c
dnet.h
dummy.c
e100.c e100: Fix ring parameter change handling regression. 2010-03-15 15:23:30 -07:00
e2100.c
eepro.c
eexpress.c
eexpress.h
enc28j60.c
enc28j60_hw.h
epic100.c
eql.c
es3210.c
eth16i.c
ethoc.c
ewrk3.c
ewrk3.h
fealnx.c
fec.c
fec.h
fec_mpc52xx.c
fec_mpc52xx.h
fec_mpc52xx_phy.c
forcedeth.c
fsl_pq_mdio.c
fsl_pq_mdio.h
gianfar.c gianfar: fix undo of reserve() 2010-03-26 20:16:23 -07:00
gianfar.h gianfar: fix undo of reserve() 2010-03-26 20:16:23 -07:00
gianfar_ethtool.c
gianfar_sysfs.c
greth.c
greth.h
hamachi.c
hp-plus.c
hp.c
hp100.c
hp100.h
hplance.c
hplance.h
hydra.c
ibmlana.c
ibmlana.h
ibmveth.c Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
ibmveth.h
ifb.c
ioc3-eth.c
ipg.c
ipg.h
iseries_veth.c Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
jazzsonic.c
jme.c jme: Protect vlgrp structure by pause RX actions. 2010-03-18 21:14:00 -07:00
jme.h jme: Advance driver version number 2010-03-18 21:14:00 -07:00
korina.c
ks8842.c
ks8851.c KS8851: Avoid NULL pointer in set rx mode 2010-03-18 21:08:48 -07:00
ks8851.h
ks8851_mll.c
ksz884x.c ksz884x: fix return value of netdev_set_eeprom 2010-03-23 13:06:15 -07:00
lance.c
lasi_82596.c
lib8390.c
lib82596.c
ll_temac.h
ll_temac_main.c
ll_temac_mdio.c
lne390.c
loopback.c
lp486e.c
mac89x0.c
mac8390.c
macb.c
macb.h
mace.c
mace.h
macmace.c
macsonic.c
macvlan.c
macvtap.c
mdio.c
meth.c
meth.h
mii.c
mipsnet.c
mv643xx_eth.c
mvme147.c
myri_sbus.c
myri_sbus.h
natsemi.c
ne-h8300.c
ne.c ne: Do not use slashes in irq name string 2010-03-16 14:15:42 -07:00
ne2.c
ne2k-pci.c
ne3210.c
netconsole.c
netx-eth.c
ni52.c
ni52.h
ni65.c
ni65.h
ni5010.c
ni5010.h
niu.c
niu.h
ns83820.c
pasemi_mac.c
pasemi_mac.h
pasemi_mac_ethtool.c
pci-skeleton.c
pcnet32.c
plip.c
ppp_async.c
ppp_deflate.c
ppp_generic.c
ppp_mppe.c
ppp_mppe.h
ppp_synctty.c
pppoe.c
pppol2tp.c l2tp: Fix UDP socket reference count bugs in the pppol2tp driver 2010-03-16 14:15:44 -07:00
pppox.c
ps3_gelic_net.c
ps3_gelic_net.h
ps3_gelic_wireless.c
ps3_gelic_wireless.h
qla3xxx.c
qla3xxx.h
r6040.c
r8169.c r8169: offical fix for CVE-2009-4537 (overlength frame DMAs) 2010-03-29 13:16:02 -07:00
rionet.c
rrunner.c
rrunner.h
s2io-regs.h
s2io.c drivers/net: drop redundant memset 2010-03-15 15:47:03 -07:00
s2io.h
s6gmac.c
sb1000.c
sb1250-mac.c
sc92031.c
seeq8005.c
seeq8005.h
sgiseeq.c
sgiseeq.h
sh_eth.c
sh_eth.h
sis190.c
sis900.c
sis900.h
skge.c
skge.h
sky2.c sky2: Avoid rtnl_unlock without rtnl_lock 2010-03-13 12:24:18 -08:00
sky2.h
slhc.c
slip.c
slip.h
smc-mca.c
smc-ultra.c
smc-ultra32.c
smc91x.c
smc91x.h net: add ColdFire support to the smc91x driver 2010-03-10 07:37:06 -08:00
smc911x.c
smc911x.h
smc9194.c
smc9194.h
smsc911x.c
smsc911x.h
smsc9420.c Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
smsc9420.h
sni_82596.c
sonic.c
sonic.h
spider_net.c Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
spider_net.h
spider_net_ethtool.c
starfire.c
stnic.c
sun3_82586.c
sun3_82586.h
sun3lance.c
sunbmac.c
sunbmac.h
sundance.c
sungem.c Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
sungem.h
sungem_phy.c
sungem_phy.h
sunhme.c
sunhme.h
sunlance.c
sunqe.c
sunqe.h
sunvnet.c
sunvnet.h
tc35815.c
tehuti.c Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
tehuti.h
tg3.c drivers/net/tg3.c: change the field used with the TG3_FLAG_10_100_ONLY constant 2010-03-13 12:22:16 -08:00
tg3.h
tlan.c
tlan.h
tsi108_eth.c
tsi108_eth.h
tun.c Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
typhoon.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2010-03-13 14:50:18 -08:00
typhoon.h
ucc_geth.c Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
ucc_geth.h
ucc_geth_ethtool.c
veth.c
via-rhine.c
via-velocity.c via-velocity: Fix FLOW_CNTL_TX_RX handling in set_mii_flow_control() 2010-03-25 11:56:32 -07:00
via-velocity.h
virtio_net.c
wd.c
xen-netfront.c
xilinx_emaclite.c
xtsonic.c
yellowfin.c
znet.c
zorro8390.c