lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

skbuff: don't corrupt mac_header on skb expansion

Browse Source 
The skb mac_header field is sometimes NULL (or ~0u) as a sentinel
value. The places where skb is expanded add an offset which would
change this flag into an invalid pointer (or offset).

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Stephen Hemminger
2009-06-17 12:17:34 +00:00
committed by David S. Miller
parent 19633e129c
commit 603a8bbe62
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
net/core/skbuff.c
View File

@@ -661,6 +661,7 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
/* {transport,network,mac}_header are relative to skb->head */ /* {transport,network,mac}_header are relative to skb->head */
new->transport_header += offset; new->transport_header += offset;
new->network_header += offset; new->network_header += offset;
if (skb_mac_header_was_set(new))
new->mac_header += offset; new->mac_header += offset;
#endif #endif
skb_shinfo(new)->gso_size = skb_shinfo(old)->gso_size; skb_shinfo(new)->gso_size = skb_shinfo(old)->gso_size;
@@ -843,6 +844,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
skb->tail += off; skb->tail += off;
skb->transport_header += off; skb->transport_header += off;
skb->network_header += off; skb->network_header += off;
if (skb_mac_header_was_set(skb))
skb->mac_header += off; skb->mac_header += off;
skb->csum_start += nhead; skb->csum_start += nhead;
skb->cloned = 0; skb->cloned = 0;
@@ -935,6 +937,7 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
#ifdef NET_SKBUFF_DATA_USES_OFFSET #ifdef NET_SKBUFF_DATA_USES_OFFSET
n->transport_header += off; n->transport_header += off;
n->network_header += off; n->network_header += off;
if (skb_mac_header_was_set(skb))
n->mac_header += off; n->mac_header += off;
#endif #endif