From: Andrew Morton <[EMAIL PROTECTED]>
Date: Wed, 19 Apr 2006 11:38:06 -0700
> Analysis:
> llc_rcv
> does a skb_clone inside skb_share_check
> llc_fixup_skb
> skb_trim
> __skb_trim
> ___pskb_trim(x,x,0) <-- realloc set to 0
> ___pskb_trim BUG on !realloc inside skb_cloned check
I'll fix it like this:
diff-tree 5185db09f46ed64d520d09db6e93852e44106628 (from
3672558c6180ca28a7aa46765702467a37e58fc5)
Author: David S. Miller <[EMAIL PROTECTED]>
Date: Wed Apr 19 15:37:13 2006 -0700
[LLC]: Use pskb_trim_rcsum() in llc_fixup_skb().
Kernel Bugzilla #6409
If we use plain skb_trim(), that's wrong, because if
the SKB is cloned, and it can be because we unshared
it in the caller, we have to allow reallocation. The
pskb_trim*() family of routines is therefore the most
appropriate here.
Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 8f3addf..d62e0f9 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -118,7 +118,8 @@ static inline int llc_fixup_skb(struct s
u16 pdulen = eth_hdr(skb)->h_proto,
data_size = ntohs(pdulen) - llc_len;
- skb_trim(skb, data_size);
+ if (unlikely(pskb_trim_rcsum(skb, data_size)))
+ return 0;
}
return 1;
}
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
