1 files changed, 20 insertions, 30 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9db7dbdb16e6..f4ccb90e6739 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -49,7 +49,6 @@
  *
  */
  
-#include <linux/config.h>
 #include <linux/types.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
@@ -428,21 +427,24 @@ out_unlock:
 }
 #endif
 
-static inline unsigned run_filter(struct sk_buff *skb, struct sock *sk, unsigned res)
+static inline int run_filter(struct sk_buff *skb, struct sock *sk,
+                                                        unsigned *snaplen)
 {
         struct sk_filter *filter;
+        int err = 0;
 
-        bh_lock_sock(sk);
-        filter = sk->sk_filter;
-        /*
-         * Our caller already checked that filter != NULL but we need to
-         * verify that under bh_lock_sock() to be safe
-         */
-        if (likely(filter != NULL))
-                res = sk_run_filter(skb, filter->insns, filter->len);
-        bh_unlock_sock(sk);
+        rcu_read_lock_bh();
+        filter = rcu_dereference(sk->sk_filter);
+        if (filter != NULL) {
+                err = sk_run_filter(skb, filter->insns, filter->len);
+                if (!err)
+                        err = -EPERM;
+                else if (*snaplen > err)
+                        *snaplen = err;
+        }
+        rcu_read_unlock_bh();
 
-        return res;
+        return err;
 }
 
 /*
@@ -492,13 +494,8 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
 
         snaplen = skb->len;
 
-        if (sk->sk_filter) {
-                unsigned res = run_filter(skb, sk, snaplen);
-                if (res == 0)
-                        goto drop_n_restore;
-                if (snaplen > res)
-                        snaplen = res;
-        }
+        if (run_filter(skb, sk, &snaplen) < 0)
+                goto drop_n_restore;
 
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned)sk->sk_rcvbuf)
@@ -587,20 +584,15 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 else if (skb->pkt_type == PACKET_OUTGOING) {
                         /* Special case: outgoing packets have ll header at head */
                         skb_pull(skb, skb->nh.raw - skb->data);
-                        if (skb->ip_summed == CHECKSUM_HW)
+                        if (skb->ip_summed == CHECKSUM_PARTIAL)
                                 status |= TP_STATUS_CSUMNOTREADY;
                 }
         }
 
         snaplen = skb->len;
 
-        if (sk->sk_filter) {
-                unsigned res = run_filter(skb, sk, snaplen);
-                if (res == 0)
-                        goto drop_n_restore;
-                if (snaplen > res)
-                        snaplen = res;
-        }
+        if (run_filter(skb, sk, &snaplen) < 0)
+                goto drop_n_restore;
 
         if (sk->sk_type == SOCK_DGRAM) {
                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
@@ -627,8 +619,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 if ((int)snaplen < 0)
                         snaplen = 0;
         }
-        if (snaplen > skb->len-skb->data_len)
-                snaplen = skb->len-skb->data_len;
 
         spin_lock(&sk->sk_receive_queue.lock);
         h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
@@ -645,7 +635,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 status &= ~TP_STATUS_LOSING;
         spin_unlock(&sk->sk_receive_queue.lock);
 
-        memcpy((u8*)h + macoff, skb->data, snaplen);
+        skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 
         h->tp_len = skb->len;
         h->tp_snaplen = snaplen;