android_kernel_xiaomi_sdm845/drivers
Neil Horman c0cd884af0 r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)
Official patch to fix the r8169 frame length check error.

Based on this initial thread:
http://marc.info/?l=linux-netdev&m=126202972828626&w=1
This is the official patch to fix the frame length problems in the r8169
driver.  As noted in the previous thread, while this patch incurs a performance
hit on the driver, its possible to improve performance dynamically by updating
the mtu and rx_copybreak values at runtime to return performance to what it was
for those NICS which are unaffected by the ideosyncracy (if there are any).

Summary:

    A while back Eric submitted a patch for r8169 in which the proper
allocated frame size was written to RXMaxSize to prevent the NIC from dmaing too
much data.  This was done in commit fdd7b4c330.  A
long time prior to that however, Francois posted
126fa4b9ca, which expiclitly disabled the MaxSize
setting due to the fact that the hardware behaved in odd ways when overlong
frames were received on NIC's supported by this driver.  This was mentioned in a
security conference recently:
http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html

It seems that if we can't enable frame size filtering, then, as Eric correctly
noticed, we can find ourselves DMA-ing too much data to a buffer, causing
corruption.  As a result is seems that we are forced to allocate a frame which
is ready to handle a maximally sized receive.

This obviously has performance issues with it, so to mitigate that issue, this
patch does two things:

1) Raises the copybreak value to the frame allocation size, which should force
appropriately sized packets to get allocated on rx, rather than a full new 16k
buffer.

2) This patch only disables frame filtering initially (i.e., during the NIC
open), changing the MTU results in ring buffer allocation of a size in relation
to the new mtu (along with a warning indicating that this is dangerous).

Because of item (2), individuals who can't cope with the performance hit (or can
otherwise filter frames to prevent the bug), or who have hardware they are sure
is unaffected by this issue, can manually lower the copybreak and reset the mtu
such that performance is restored easily.

Signed-off-by: Neil Horman <nhorman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-03-29 13:16:02 -07:00
..
accessibility
acpi backlight: Allow properties to be passed at registration 2010-03-16 19:47:54 +00:00
amba
ata ahci: pp->active_link is not reliable when FBS is enabled 2010-03-17 15:54:55 -04:00
atm atm: use for_each_set_bit() 2010-03-15 16:00:47 -07:00
auxdisplay auxdisplay: move cfag12864bfb's probe function to .devinit.text 2010-03-07 17:04:50 -08:00
base Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2010-03-19 13:39:42 -07:00
block Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2010-03-12 16:04:50 -08:00
bluetooth Bluetooth: Convert Marvell driver to use per adapter debugfs 2010-02-27 14:05:38 +01:00
cdrom
char virtio: console: Check if port is valid in resize_console 2010-03-22 14:24:55 +02:00
clocksource MFGPT: move clocksource menu 2010-03-06 11:26:28 -08:00
connector
cpufreq Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
cpuidle Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
crypto Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
dca
dio
dma Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2010-03-12 16:04:50 -08:00
edac edac, mce: Filter out invalid values 2010-03-22 16:33:31 +01:00
eisa eisa: fix coding style for eisa bus code 2010-03-06 11:26:32 -08:00
firewire Driver core: create lock/unlock functions for struct device 2010-03-07 17:04:52 -08:00
firmware Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
gpio driver-core: Add attribute argument to class_attribute show/store 2010-03-07 17:04:48 -08:00
gpu backlight: Allow properties to be passed at registration 2010-03-16 19:47:54 +00:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2010-03-18 16:52:31 -07:00
hwmon Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging 2010-03-06 11:33:09 -08:00
i2c Add include to i2c-xii.c to fix build error 2010-03-14 11:14:58 -07:00
ide Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-next-2.6 2010-03-04 08:24:06 -08:00
idle
ieee1394 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2010-03-12 16:04:50 -08:00
ieee802154
infiniband Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2010-03-19 13:39:42 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2010-03-14 11:13:54 -07:00
isdn isdn: Cleanup Sections in PCMCIA driver elsa 2010-03-25 11:58:02 -07:00
leds leds: Fix race between LED device uevent and actual attributes creation 2010-03-16 20:27:25 +00:00
lguest
macintosh backlight: Allow properties to be passed at registration 2010-03-16 19:47:54 +00:00
mca
md Merge branch 'for-linus' of git://neil.brown.name/md 2010-03-18 16:55:24 -07:00
media Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2010-03-14 11:13:54 -07:00
memstick
message Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
mfd Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6 2010-03-12 16:41:09 -08:00
misc init dynamic bin_attribute structures 2010-03-14 20:28:39 -07:00
mmc Merge branch 'msm-mmc_sdcc' of git://codeaurora.org/quic/kernel/dwalker/linux-msm 2010-03-12 16:21:24 -08:00
mtd Delete zero-length file drivers/mtd/maps/omap_nor.c 2010-03-19 14:25:45 -04:00
net r8169: offical fix for CVE-2009-4537 (overlength frame DMAs) 2010-03-29 13:16:02 -07:00
nubus
of
oprofile
parisc Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
parport Merge branch 'for-next' into for-linus 2010-03-08 16:55:37 +01:00
pci Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2010-03-19 13:39:42 -07:00
pcmcia PCMCIA: resource, fix lock imbalance 2010-03-16 17:54:58 +01:00
platform backlight: panasonic-laptop - Fix incomplete registration failure handling 2010-03-16 20:13:31 +00:00
pnp PNPACPI: add bus number support 2010-03-14 20:08:38 -04:00
power Merge branches 'battery-2.6.34', 'bugzilla-10805', 'bugzilla-14668', 'bugzilla-531916-power-state', 'ht-warn-2.6.34', 'pnp', 'processor-rename', 'sony-2.6.34', 'suse-bugzilla-531547', 'tz-check', 'video' and 'misc-2.6.34' into release 2010-03-14 21:30:17 -04:00
pps pps: serial clients support 2010-03-12 15:52:43 -08:00
ps3
rapidio
regulator regulator: Add max8925 support 2010-03-07 22:17:08 +01:00
rtc init dynamic bin_attribute structures 2010-03-14 20:28:39 -07:00
s390 memory hotplug/s390: set phys_device 2010-03-17 18:43:47 -07:00
sbus
scsi Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2010-03-18 16:54:31 -07:00
serial pcnet_cs: add new id 2010-03-27 16:41:28 -07:00
sfi
sh Merge git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 2010-03-19 18:16:20 -07:00
sn
spi Merge branch 'merge' of git://git.secretlab.ca/git/linux-2.6 2010-03-18 17:01:19 -07:00
ssb
staging backlight: Allow properties to be passed at registration 2010-03-16 19:47:54 +00:00
tc
telephony
thermal
uio UIO: Remove SMX Cryptengine driver 2010-03-07 17:04:51 -08:00
usb Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6 2010-03-19 13:40:03 -07:00
uwb Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/dvrabel/uwb 2010-03-19 18:14:22 -07:00
vhost vhost: fix error handling in vring ioctls 2010-03-17 23:07:35 +02:00
video Merge master.kernel.org:/home/rmk/linux-2.6-arm 2010-03-18 16:59:10 -07:00
virtio virtio: set pci bus master enable bit 2010-03-02 13:41:14 +02:00
vlynq
w1 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2010-03-12 16:04:50 -08:00
watchdog [WATCHDOG] i6300esb.c: change platform_driver to pci_driver 2010-03-08 13:48:01 +00:00
xen Driver core: Constify struct sysfs_ops in struct kobj_type 2010-03-07 17:04:49 -08:00
zorro
Kconfig MFGPT: move clocksource menu 2010-03-06 11:26:28 -08:00
Makefile Merge branch 'origin' into devel-stable 2010-03-08 20:21:04 +00:00