1 files changed, 32 insertions, 9 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 91cb1d71f018..b5362e96022b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -164,7 +164,6 @@ struct packet_mreq_max {
 static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 int closing, int tx_ring);
 
-#define PGV_FROM_VMALLOC 1
 struct pgv {
         char *buffer;
 };
@@ -466,7 +465,7 @@ retry:
          */
 
         err = -EMSGSIZE;
-        if (len > dev->mtu + dev->hard_header_len)
+        if (len > dev->mtu + dev->hard_header_len + VLAN_HLEN)
                 goto out_unlock;
 
         if (!skb) {
@@ -497,6 +496,19 @@ retry:
                 goto retry;
         }
 
+        if (len > (dev->mtu + dev->hard_header_len)) {
+                /* Earlier code assumed this would be a VLAN pkt,
+                 * double-check this now that we have the actual
+                 * packet in hand.
+                 */
+                struct ethhdr *ehdr;
+                skb_reset_mac_header(skb);
+                ehdr = eth_hdr(skb);
+                if (ehdr->h_proto != htons(ETH_P_8021Q)) {
+                        err = -EMSGSIZE;
+                        goto out_unlock;
+                }
+        }
 
         skb->protocol = proto;
         skb->dev = dev;
@@ -523,11 +535,11 @@ static inline unsigned int run_filter(const struct sk_buff *skb,
 {
         struct sk_filter *filter;
 
-        rcu_read_lock_bh();
-        filter = rcu_dereference_bh(sk->sk_filter);
+        rcu_read_lock();
+        filter = rcu_dereference(sk->sk_filter);
         if (filter != NULL)
                 res = sk_run_filter(skb, filter->insns);
-        rcu_read_unlock_bh();
+        rcu_read_unlock();
 
         return res;
 }
@@ -954,7 +966,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
 
 static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 {
-        struct socket *sock;
         struct sk_buff *skb;
         struct net_device *dev;
         __be16 proto;
@@ -966,8 +977,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         int len_sum = 0;
         int status = 0;
 
-        sock = po->sk.sk_socket;
-
         mutex_lock(&po->pg_vec_lock);
 
         err = -EBUSY;
@@ -1200,7 +1209,7 @@ static int packet_snd(struct socket *sock,
         }
 
         err = -EMSGSIZE;
-        if (!gso_type && (len > dev->mtu+reserve))
+        if (!gso_type && (len > dev->mtu + reserve + VLAN_HLEN))
                 goto out_unlock;
 
         err = -ENOBUFS;
@@ -1225,6 +1234,20 @@ static int packet_snd(struct socket *sock,
         if (err < 0)
                 goto out_free;
 
+        if (!gso_type && (len > dev->mtu + reserve)) {
+                /* Earlier code assumed this would be a VLAN pkt,
+                 * double-check this now that we have the actual
+                 * packet in hand.
+                 */
+                struct ethhdr *ehdr;
+                skb_reset_mac_header(skb);
+                ehdr = eth_hdr(skb);
+                if (ehdr->h_proto != htons(ETH_P_8021Q)) {
+                        err = -EMSGSIZE;
+                        goto out_free;
+                }
+        }
+
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;