packet: tpacket_v3: do not trigger bug() on wrong header status
authorDaniel Borkmann <dborkman@redhat.com>
Fri, 3 May 2013 02:57:00 +0000 (02:57 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 19 May 2013 17:54:46 +0000 (10:54 -0700)
commit2cbf196bdbc142f8d66de1bf95f4ff9b230c1b10
treed5a4f2a68b5f3476dcd871a9dfc4a24b02c1d20c
parent7157a527af680c157244db79f2d7f15d889f2ad1
packet: tpacket_v3: do not trigger bug() on wrong header status

[ Upstream commit 8da3056c04bfc5f69f840ab038a38389e2de8189 ]

Jakub reported that it is fairly easy to trigger the BUG() macro
from user space with TPACKET_V3's RX_RING by just giving a wrong
header status flag. We already had a similar situation in commit
7f5c3e3a80e6654 (``af_packet: remove BUG statement in
tpacket_destruct_skb'') where this was the case in the TX_RING
side that could be triggered from user space. So really, don't use
BUG() or BUG_ON() unless there's really no way out, and i.e.
don't use it for consistency checking when there's user space
involved, no excuses, especially not if you're slapping the user
with WARN + dump_stack + BUG all at once. The two functions are
of concern:

  prb_retire_current_block() [when block status != TP_STATUS_KERNEL]
  prb_open_block() [when block_status != TP_STATUS_KERNEL]

Calls to prb_open_block() are guarded by ealier checks if block_status
is really TP_STATUS_KERNEL (racy!), but the first one BUG() is easily
triggable from user space. System behaves still stable after they are
removed. Also remove that yoda condition entirely, since it's already
guarded.

Reported-by: Jakub Zawadzki <darkjames-ws@darkjames.pl>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/packet/af_packet.c