lkml.org 
[lkml]   [2006]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH 39/61] NET: Fix skb_segment() handling of fully linear SKBs
    -stable review patch.  If anyone has any objections, please let us know.
    ------------------

    From: Herbert Xu <herbert@gondor.apana.org.au>

    [NET]: Fix segmentation of linear packets

    skb_segment fails to segment linear packets correctly because it
    tries to write all linear parts of the original skb into each
    segment. This will always panic as each segment only contains
    enough space for one MSS.

    This was not detected earlier because linear packets should be
    rare for GSO. In fact it still remains to be seen what exactly
    created the linear packets that triggered this bug. Basically
    the only time this should happen is if someone enables GSO
    emulation on an interface that does not support SG.

    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

    ---
    net/core/skbuff.c | 9 ++++-----
    1 file changed, 4 insertions(+), 5 deletions(-)

    --- linux-2.6.18.1.orig/net/core/skbuff.c
    +++ linux-2.6.18.1/net/core/skbuff.c
    @@ -1945,7 +1945,7 @@ struct sk_buff *skb_segment(struct sk_bu
    do {
    struct sk_buff *nskb;
    skb_frag_t *frag;
    - int hsize, nsize;
    + int hsize;
    int k;
    int size;

    @@ -1956,11 +1956,10 @@ struct sk_buff *skb_segment(struct sk_bu
    hsize = skb_headlen(skb) - offset;
    if (hsize < 0)
    hsize = 0;
    - nsize = hsize + doffset;
    - if (nsize > len + doffset || !sg)
    - nsize = len + doffset;
    + if (hsize > len || !sg)
    + hsize = len;

    - nskb = alloc_skb(nsize + headroom, GFP_ATOMIC);
    + nskb = alloc_skb(hsize + doffset + headroom, GFP_ATOMIC);
    if (unlikely(!nskb))
    goto err;

    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-11-01 06:55    [W:0.024 / U:32.364 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site