[IPV6] NDISC: Calculate packet length correctly for allocation.

[safe/jmp/linux-2.6] / net / packet / af_packet.c

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f69e5ed..f4ccb90 100644 (file)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -49,10 +49,10 @@
  *
  */
  
-#include <linux/config.h>
 #include <linux/types.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
+#include <linux/capability.h>
 #include <linux/fcntl.h>
 #include <linux/socket.h>
 #include <linux/in.h>
@@ -364,7 +364,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         */
         
        err = -EMSGSIZE;
-       if(len>dev->mtu+dev->hard_header_len)
+       if (len > dev->mtu + dev->hard_header_len)
                goto out_unlock;
 
        err = -ENOBUFS;
@@ -427,21 +427,24 @@ out_unlock:
 }
 #endif
 
-static inline unsigned run_filter(struct sk_buff *skb, struct sock *sk, unsigned res)
+static inline int run_filter(struct sk_buff *skb, struct sock *sk,
+                                                       unsigned *snaplen)
 {
        struct sk_filter *filter;
+       int err = 0;
 
-       bh_lock_sock(sk);
-       filter = sk->sk_filter;
-       /*
-        * Our caller already checked that filter != NULL but we need to
-        * verify that under bh_lock_sock() to be safe
-        */
-       if (likely(filter != NULL))
-               res = sk_run_filter(skb, filter->insns, filter->len);
-       bh_unlock_sock(sk);
+       rcu_read_lock_bh();
+       filter = rcu_dereference(sk->sk_filter);
+       if (filter != NULL) {
+               err = sk_run_filter(skb, filter->insns, filter->len);
+               if (!err)
+                       err = -EPERM;
+               else if (*snaplen > err)
+                       *snaplen = err;
+       }
+       rcu_read_unlock_bh();
 
-       return res;
+       return err;
 }
 
 /*
@@ -491,13 +494,8 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
 
        snaplen = skb->len;
 
-       if (sk->sk_filter) {
-               unsigned res = run_filter(skb, sk, snaplen);
-               if (res == 0)
-                       goto drop_n_restore;
-               if (snaplen > res)
-                       snaplen = res;
-       }
+       if (run_filter(skb, sk, &snaplen) < 0)
+               goto drop_n_restore;
 
        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
            (unsigned)sk->sk_rcvbuf)
@@ -586,20 +584,15 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                else if (skb->pkt_type == PACKET_OUTGOING) {
                        /* Special case: outgoing packets have ll header at head */
                        skb_pull(skb, skb->nh.raw - skb->data);
-                       if (skb->ip_summed == CHECKSUM_HW)
+                       if (skb->ip_summed == CHECKSUM_PARTIAL)
                                status |= TP_STATUS_CSUMNOTREADY;
                }
        }
 
        snaplen = skb->len;
 
-       if (sk->sk_filter) {
-               unsigned res = run_filter(skb, sk, snaplen);
-               if (res == 0)
-                       goto drop_n_restore;
-               if (snaplen > res)
-                       snaplen = res;
-       }
+       if (run_filter(skb, sk, &snaplen) < 0)
+               goto drop_n_restore;
 
        if (sk->sk_type == SOCK_DGRAM) {
                macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
@@ -626,8 +619,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                if ((int)snaplen < 0)
                        snaplen = 0;
        }
-       if (snaplen > skb->len-skb->data_len)
-               snaplen = skb->len-skb->data_len;
 
        spin_lock(&sk->sk_receive_queue.lock);
        h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
@@ -644,7 +635,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                status &= ~TP_STATUS_LOSING;
        spin_unlock(&sk->sk_receive_queue.lock);
 
-       memcpy((u8*)h + macoff, skb->data, snaplen);
+       skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 
        h->tp_len = skb->len;
        h->tp_snaplen = snaplen;
@@ -934,7 +925,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int add
         *      Check legality
         */
         
-       if(addr_len!=sizeof(struct sockaddr))
+       if (addr_len != sizeof(struct sockaddr))
                return -EINVAL;
        strlcpy(name,uaddr->sa_data,sizeof(name));
 
@@ -1091,7 +1082,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         *      retries.
         */
 
-       if(skb==NULL)
+       if (skb == NULL)
                goto out;
 
        /*
@@ -1237,7 +1228,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
                goto done;
 
        err = -ENOBUFS;
-       i = (struct packet_mclist *)kmalloc(sizeof(*i), GFP_KERNEL);
+       i = kmalloc(sizeof(*i), GFP_KERNEL);
        if (i == NULL)
                goto done;
 
@@ -1391,8 +1382,8 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
        if (level != SOL_PACKET)
                return -ENOPROTOOPT;
 
-       if (get_user(len,optlen))
-               return -EFAULT;
+       if (get_user(len, optlen))
+               return -EFAULT;
 
        if (len < 0)
                return -EINVAL;
@@ -1418,9 +1409,9 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                return -ENOPROTOOPT;
        }
 
-       if (put_user(len, optlen))
-               return -EFAULT;
-       return 0;
+       if (put_user(len, optlen))
+               return -EFAULT;
+       return 0;
 }