David, I'm going to not apply the following patch, as I'm guessing it will be coming with a set of stable networking patches later on.
Unless you want me to apply it to the trees now? thanks, greg k-h On Tue, Dec 11, 2012 at 09:45:04AM -0500, Gregs git-bot wrote: > commit: 1bf3751ec90cc3174e01f0d701e8449ce163d113 > From: Johannes Berg <[email protected]> > Date: Sun, 9 Dec 2012 23:41:06 +0000 > Subject: ipv4: ip_check_defrag must not modify skb before unsharing > > ip_check_defrag() might be called from af_packet within the > RX path where shared SKBs are used, so it must not modify > the input SKB before it has unshared it for defragmentation. > Use skb_copy_bits() to get the IP header and only pull in > everything later. > > The same is true for the other caller in macvlan as it is > called from dev->rx_handler which can also get a shared SKB. > > Reported-by: Eric Leblond <[email protected]> > Cc: [email protected] > Signed-off-by: Johannes Berg <[email protected]> > Signed-off-by: David S. Miller <[email protected]> > --- > net/ipv4/ip_fragment.c | 19 +++++++++---------- > 1 files changed, 9 insertions(+), 10 deletions(-) > > diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c > index 448e685..8d5cc75 100644 > --- a/net/ipv4/ip_fragment.c > +++ b/net/ipv4/ip_fragment.c > @@ -707,28 +707,27 @@ EXPORT_SYMBOL(ip_defrag); > > struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user) > { > - const struct iphdr *iph; > + struct iphdr iph; > u32 len; > > if (skb->protocol != htons(ETH_P_IP)) > return skb; > > - if (!pskb_may_pull(skb, sizeof(struct iphdr))) > + if (!skb_copy_bits(skb, 0, &iph, sizeof(iph))) > return skb; > > - iph = ip_hdr(skb); > - if (iph->ihl < 5 || iph->version != 4) > + if (iph.ihl < 5 || iph.version != 4) > return skb; > - if (!pskb_may_pull(skb, iph->ihl*4)) > - return skb; > - iph = ip_hdr(skb); > - len = ntohs(iph->tot_len); > - if (skb->len < len || len < (iph->ihl * 4)) > + > + len = ntohs(iph.tot_len); > + if (skb->len < len || len < (iph.ihl * 4)) > return skb; > > - if (ip_is_fragment(ip_hdr(skb))) { > + if (ip_is_fragment(&iph)) { > skb = skb_share_check(skb, GFP_ATOMIC); > if (skb) { > + if (!pskb_may_pull(skb, iph.ihl*4)) > + return skb; > if (pskb_trim_rcsum(skb, len)) > return skb; > memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); > -- > 1.7.3.4 > -- > To unsubscribe from this list: send the line "unsubscribe stable" in > the body of a message to [email protected] > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
