Re: [Linux-ATM-General] [RFC][PATCH 0/2] atm: br2682: Improve encapsulation checks and headroom allocation

[Pascal H. <pa...@pl...>]

chas williams - CONTRACTOR a écrit :
> On Mon, 08 Aug 2011 00:05:24 +0200
> Pascal Hambourg <pa...@pl...> wrote:
> 
>> Also it appears that eth_type_trans(), which is called in the bridged receive
>> path in br2684_push(), calls skb_pull(skb, ETH_HLEN). Shouldn't the packet
>> length be checked before calling eth_type_trans() ?
> 
> probably.  i dont see any reason it shouldnt be checked.
> 
>> Similarly, shouldn't the packet length be checked in the VC-MUX routed path
>> before reading the IP header version ?
> 
> yes, that seems reasonable.

I updated and resent the patch 1/2 (v2) accordingly :

- Check that the LLC header matches the expected payload type.
- Check that the PAD field is 0x00-00 also in LLC bridged mode.
- Check that the frame length in bridged mode is at least ETH_HLEN (14)
  without FCS or ETH_ZLEN + ETH_FCS_LEN (64) with FCS.
- Trim the trailing FCS field only if the PID is ethernet with FCS.
- Check the data length is not null before reading the IP header version
  field in VC-MUX routed mode.

As usual, I did minimal testing to check there is no obvious regression.

The optimizations you suggested are way beyond my skill and knowledge of the
kernel code. My goal here was just to provide fixes with minimal changes which
could also be easily backported to the -stable and -longterm trees.

Cheers,
--