This is a note to let you know that I've just added the patch titled
econet: Fix crash in aun_incoming().
to the 2.6.36-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
econet-fix-crash-in-aun_incoming.patch
and it can be found in the queue-2.6.36 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From ca737e3fe3069e4f6cd78104679e368c4e8bbafa Mon Sep 17 00:00:00 2001
From: David S. Miller <[email protected]>
Date: Wed, 8 Dec 2010 18:42:23 -0800
Subject: econet: Fix crash in aun_incoming().
From: David S. Miller <[email protected]>
[ Upstream commit 4e085e76cbe558b79b54cbab772f61185879bc64 ]
Unconditional use of skb->dev won't work here,
try to fetch the econet device via skb_dst()->dev
instead.
Suggested by Eric Dumazet.
Reported-by: Nelson Elhage <[email protected]>
Tested-by: Nelson Elhage <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/econet/af_econet.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -851,9 +851,13 @@ static void aun_incoming(struct sk_buff
{
struct iphdr *ip = ip_hdr(skb);
unsigned char stn = ntohl(ip->saddr) & 0xff;
+ struct dst_entry *dst = skb_dst(skb);
+ struct ec_device *edev = NULL;
struct sock *sk = NULL;
struct sk_buff *newskb;
- struct ec_device *edev = skb->dev->ec_ptr;
+
+ if (dst)
+ edev = dst->dev->ec_ptr;
if (! edev)
goto bad;
Patches currently in stable-queue which might be from [email protected] are
queue-2.6.36/driver-net-benet-fix-be_cmd_multicast_set-memcpy-bug.patch
queue-2.6.36/sparc64-delete-prom_puts-unused.patch
queue-2.6.36/sparc-remove-prom_pathtoinode.patch
queue-2.6.36/bridge-fix-ipv6-queries-for-bridge-multicast-snooping.patch
queue-2.6.36/tcp-protect-sysctl_tcp_cookie_size-reads.patch
queue-2.6.36/tcp-don-t-change-unlocked-socket-state-in-tcp_v4_err.patch
queue-2.6.36/net-dst-dst_dev_event-called-after-other-notifiers.patch
queue-2.6.36/r8169-fix-sleeping-while-holding-spinlock.patch
queue-2.6.36/l2tp-fix-modalias-of-l2tp_ip.patch
queue-2.6.36/sparc64-delete-prom_setcallback.patch
queue-2.6.36/pppoe.c-fix-kernel-panic-caused-by-__pppoe_xmit.patch
queue-2.6.36/bonding-fix-slave-selection-bug.patch
queue-2.6.36/sparc-do-not-export-prom_nb-get-put-char.patch
queue-2.6.36/econet-do-the-correct-cleanup-after-an-unprivileged-siocsifaddr.patch
queue-2.6.36/sparc-write-to-prom-console-using-indirect-buffer.patch
queue-2.6.36/econet-fix-crash-in-aun_incoming.patch
queue-2.6.36/sparc-delete-prom_-getchar.patch
queue-2.6.36/net-fix-skb_defer_rx_timestamp.patch
queue-2.6.36/net-fix-header-size-check-for-gso-case-in-recvmsg-af_packet.patch
queue-2.6.36/net-ax25-fix-information-leak-to-userland.patch
queue-2.6.36/sparc-kill-prom-devops_-32-64-.c.patch
queue-2.6.36/filter-fix-sk_filter-rcu-handling.patch
queue-2.6.36/cls_cgroup-fix-crash-on-module-unload.patch
queue-2.6.36/sparc-pass-buffer-pointer-all-the-way-down-to-prom_-get-put-char.patch
queue-2.6.36/af_unix-limit-unix_tot_inflight.patch
queue-2.6.36/tcp-increase-tcp_maxseg-socket-option-minimum.patch
queue-2.6.36/ifb-goto-resched-directly-if-error-happens-and-dp-tq-isn-t-empty.patch
queue-2.6.36/tcp-make-tcp_maxseg-minimum-more-correct.patch
queue-2.6.36/x25-decrement-netdev-reference-counts-on-unload.patch
queue-2.6.36/llc-fix-a-device-refcount-imbalance.patch
queue-2.6.36/tcp-bug-fix-in-initialization-of-receive-window.patch
queue-2.6.36/tehuti-firmware-filename-is-tehuti-bdx.bin.patch
queue-2.6.36/af_unix-limit-recursion-level.patch
queue-2.6.36/net-packet-fix-information-leak-to-userland.patch
queue-2.6.36/tcp-avoid-a-possible-divide-by-zero.patch
queue-2.6.36/sparc64-unexport-prom_service_exists.patch
queue-2.6.36/sparc-leon-removed-constant-timer-initialization-as-if-hz-100-now-it-reflects-the-value-of-hz.patch
queue-2.6.36/8139cp-fix-checksum-broken.patch
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
