releases/3.10.94/virtio-net-drop-netif_f_fraglist.patch

   1 From foo@baz Sat Dec  5 21:18:34 PST 2015
   2 From: Jason Wang <jasowang@redhat.com>
   3 Date: Wed, 5 Aug 2015 10:34:04 +0800
   4 Subject: virtio-net: drop NETIF_F_FRAGLIST
   5
   6 From: Jason Wang <jasowang@redhat.com>
   7
   8 [ Upstream commit 48900cb6af4282fa0fb6ff4d72a81aa3dadb5c39 ]
   9
  10 virtio declares support for NETIF_F_FRAGLIST, but assumes
  11 that there are at most MAX_SKB_FRAGS + 2 fragments which isn't
  12 always true with a fraglist.
  13
  14 A longer fraglist in the skb will make the call to skb_to_sgvec overflow
  15 the sg array, leading to memory corruption.
  16
  17 Drop NETIF_F_FRAGLIST so we only get what we can handle.
  18
  19 Cc: Michael S. Tsirkin <mst@redhat.com>
  20 Signed-off-by: Jason Wang <jasowang@redhat.com>
  21 Acked-by: Michael S. Tsirkin <mst@redhat.com>
  22 Signed-off-by: David S. Miller <davem@davemloft.net>
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24 ---
  25  drivers/net/virtio_net.c |    4 ++--
  26  1 file changed, 2 insertions(+), 2 deletions(-)
  27
  28 --- a/drivers/net/virtio_net.c
  29 +++ b/drivers/net/virtio_net.c
  30 @@ -1545,9 +1545,9 @@ static int virtnet_probe(struct virtio_d
  31         /* Do we support "hardware" checksums? */
  32         if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
  33                 /* This opens up the world of extra features. */
  34 -               dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
  35 +               dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG;
  36                 if (csum)
  37 -                       dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
  38 +                       dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
  39
  40                 if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
  41                         dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO