tree b39e944fd63e183d443ee5ddcbb9d60e787cbc22
parent df4198b1e0c4a7d1adde1e5c2ceb67ac10b391bb
author Jason Wang <jasowang@redhat.com> 1438742044 +0800
committer Michael S. Tsirkin <mst@redhat.com> 1438867108 +0300

virtio-net: drop NETIF_F_FRAGLIST

virtio declares support for NETIF_F_FRAGLIST, but assumes
that there are at most MAX_SKB_FRAGS + 2 fragments which isn't
always true with a fraglist.

A longer fraglist in the skb will make the call to skb_to_sgvec overflow
the sg array, leading to memory corruption.

Drop NETIF_F_FRAGLIST so we only get what we can handle.

CVE-2015-5156

Cc: stable@vger.kernel.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>