1 files changed, 84 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.24/0020-macvtap-zerocopy-validate-vectors-before-building-sk.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.24/0020-macvtap-zerocopy-validate-vectors-before-building-sk.patch
new file mode 100644
index 00000000..a46ddcbc
--- /dev/null
+++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.24/0020-macvtap-zerocopy-validate-vectors-before-building-sk.patch
@@ -0,0 +1,84 @@
+From c93ad33631e3efbb6f02f24c6b6817227b2c9252 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Wed, 2 May 2012 11:42:15 +0800
+Subject: [PATCH 020/109] macvtap: zerocopy: validate vectors before building
+ skb
+
+commit b92946e2919134ebe2a4083e4302236295ea2a73 upstream.
+
+There're several reasons that the vectors need to be validated:
+
+- Return error when caller provides vectors whose num is greater than UIO_MAXIOV.
+- Linearize part of skb when userspace provides vectors grater than MAX_SKB_FRAGS.
+- Return error when userspace provides vectors whose total length may exceed
+- MAX_SKB_FRAGS * PAGE_SIZE.
+
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/macvtap.c |   25 +++++++++++++++++++++----
+ 1 files changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index 7fecd66..26106c0 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -528,9 +528,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
+                }
+                base = (unsigned long)from->iov_base + offset;
+                size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
++               if (i + size > MAX_SKB_FRAGS)
++                       return -EMSGSIZE;
+                num_pages = get_user_pages_fast(base, size, 0, &page[i]);
+-               if ((num_pages != size) ||
+-                   (num_pages > MAX_SKB_FRAGS - skb_shinfo(skb)->nr_frags)) {
++               if (num_pages != size) {
+                        for (i = 0; i < num_pages; i++)
+                                put_page(page[i]);
+                        return -EFAULT;
+@@ -650,7 +651,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+        int err;
+        struct virtio_net_hdr vnet_hdr = { 0 };
+        int vnet_hdr_len = 0;
+-       int copylen;
++       int copylen = 0;
+        bool zerocopy = false;
+ 
+        if (q->flags & IFF_VNET_HDR) {
+@@ -679,15 +680,31 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+        if (unlikely(len < ETH_HLEN))
+                goto err;
+ 
++       err = -EMSGSIZE;
++       if (unlikely(count > UIO_MAXIOV))
++               goto err;
++
+        if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))
+                zerocopy = true;
+ 
+        if (zerocopy) {
++               /* Userspace may produce vectors with count greater than
++                * MAX_SKB_FRAGS, so we need to linearize parts of the skb
++                * to let the rest of data to be fit in the frags.
++                */
++               if (count > MAX_SKB_FRAGS) {
++                       copylen = iov_length(iv, count - MAX_SKB_FRAGS);
++                       if (copylen < vnet_hdr_len)
++                               copylen = 0;
++                       else
++                               copylen -= vnet_hdr_len;
++               }
+                /* There are 256 bytes to be copied in skb, so there is enough
+                 * room for skb expand head in case it is used.
+                 * The rest buffer is mapped from userspace.
+                 */
+-               copylen = vnet_hdr.hdr_len;
++               if (copylen < vnet_hdr.hdr_len)
++                       copylen = vnet_hdr.hdr_len;
+                if (!copylen)
+                        copylen = GOODCOPY_LEN;
+        } else
+-- 
+1.7.7.6
+