Messages in this thread Patch in this message | | | Date | Fri, 08 Dec 2006 15:58:09 -0800 | From | Chris Wright <> | Subject | [patch 18/32] TOKENRING: Remote memory corruptor in ibmtr.c |
| |
-stable review patch. If anyone has any objections, please let us know. ------------------
From: David Miller <davem@davemloft.net>
ip_summed changes last summer had missed that one. As the result, we have ip_summed interpreted as CHECKSUM_PARTIAL now. IOW, ->csum is interpreted as offset of checksum in the packet. net/core/* will both read and modify the value as that offset, with obvious reasons. At the very least it's a remote memory corruptor.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org> --- commit b1875feda8c1735915e12d953acba85d96129f6a Author: Al Viro <viro@zeniv.linux.org.uk> Date: Mon Dec 4 19:37:42 2006 -0800
drivers/net/tokenring/ibmtr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.19.orig/drivers/net/tokenring/ibmtr.c +++ linux-2.6.19/drivers/net/tokenring/ibmtr.c @@ -1826,7 +1826,7 @@ static void tr_rx(struct net_device *dev skb->protocol = tr_type_trans(skb, dev); if (IPv4_p) { skb->csum = chksum; - skb->ip_summed = 1; + skb->ip_summed = CHECKSUM_COMPLETE; } netif_rx(skb); dev->last_rx = jiffies; -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |