Messages in this thread Patch in this message | | | Date | Mon, 6 Oct 2008 17:39:57 -0700 | From | Greg KH <> | Subject | [patch 56/71] ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space |
| |
2.6.26-stable review patch. If anyone has any objections, please let us know.
------------------ From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit d01dbeb6af7a0848063033f73c3d146fec7451f3 ]
We're never supposed to shrink the headroom or tailroom. In fact, shrinking the headroom is a fatal action.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- net/xfrm/xfrm_output.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
--- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -27,10 +27,14 @@ static int xfrm_state_check_space(struct - skb_headroom(skb); int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); - if (nhead > 0 || ntail > 0) - return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); + if (nhead <= 0) { + if (ntail <= 0) + return 0; + nhead = 0; + } else if (ntail < 0) + ntail = 0; - return 0; + return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); } static int xfrm_output_one(struct sk_buff *skb, int err) --
| |