Commit e5a498e9 authored Dec 06, 2013 by Ben Hutchings

sfc: Add length checks to efx_xmit_with_hwtstamp() and efx_ptp_is_ptp_tx()



efx_ptp_is_ptp_tx() must be robust against skbs from raw sockets that
have invalid IPv4 and UDP headers.

Add checks that:
- the transport header has been found
- there is enough space between network and transport header offset
  for an IPv4 header
- there is enough space after the transport header offset for a
  UDP header

Fixes: 7c236c43 ('sfc: Add support for IEEE-1588 PTP')
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>

parent e1ca87bb

drivers/net/ethernet/sfc/ptp.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -989,7 +989,11 @@ bool efx_ptp_is_ptp_tx(struct efx_nic efx, struct sk_buff skb)
		skb->len >= PTP_MIN_LENGTH &&
		skb->len <= MC_CMD_PTP_IN_TRANSMIT_PACKET_MAXNUM &&
		likely(skb->protocol == htons(ETH_P_IP)) &&
		skb_transport_header_was_set(skb) &&
		skb_network_header_len(skb) >= sizeof(struct iphdr) &&
		ip_hdr(skb)->protocol == IPPROTO_UDP &&
		skb_headlen(skb) >=
		skb_transport_offset(skb) + sizeof(struct udphdr) &&
		udp_hdr(skb)->dest == htons(PTP_EVENT_PORT);
		}