lkml.org 
[lkml]   [2012]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 19/31] net: Fix skb_under_panic oops in neigh_resolve_output
    Date
    3.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------


    From: "ramesh.nagappa@gmail.com" <ramesh.nagappa@gmail.com>

    [ Upstream commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c ]

    The retry loop in neigh_resolve_output() and neigh_connected_output()
    call dev_hard_header() with out reseting the skb to network_header.
    This causes the retry to fail with skb_under_panic. The fix is to
    reset the network_header within the retry loop.

    Signed-off-by: Ramesh Nagappa <ramesh.nagappa@ericsson.com>
    Reviewed-by: Shawn Lu <shawn.lu@ericsson.com>
    Reviewed-by: Robert Coulson <robert.coulson@ericsson.com>
    Reviewed-by: Billie Alsup <billie.alsup@ericsson.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/core/neighbour.c | 6 ++----
    1 file changed, 2 insertions(+), 4 deletions(-)

    --- a/net/core/neighbour.c
    +++ b/net/core/neighbour.c
    @@ -1313,8 +1313,6 @@ int neigh_resolve_output(struct sk_buff
    if (!dst)
    goto discard;

    - __skb_pull(skb, skb_network_offset(skb));
    -
    if (!neigh_event_send(neigh, skb)) {
    int err;
    struct net_device *dev = neigh->dev;
    @@ -1326,6 +1324,7 @@ int neigh_resolve_output(struct sk_buff
    neigh_hh_init(neigh, dst, dst->ops->protocol);

    do {
    + __skb_pull(skb, skb_network_offset(skb));
    seq = read_seqbegin(&neigh->ha_lock);
    err = dev_hard_header(skb, dev, ntohs(skb->protocol),
    neigh->ha, NULL, skb->len);
    @@ -1358,9 +1357,8 @@ int neigh_connected_output(struct sk_buf
    struct net_device *dev = neigh->dev;
    unsigned int seq;

    - __skb_pull(skb, skb_network_offset(skb));
    -
    do {
    + __skb_pull(skb, skb_network_offset(skb));
    seq = read_seqbegin(&neigh->ha_lock);
    err = dev_hard_header(skb, dev, ntohs(skb->protocol),
    neigh->ha, NULL, skb->len);



    \
     
     \ /
      Last update: 2012-10-26 04:01    [W:3.389 / U:1.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site