Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760055AbZFIKQR (ORCPT ); Tue, 9 Jun 2009 06:16:17 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1759747AbZFIKPg (ORCPT ); Tue, 9 Jun 2009 06:15:36 -0400 Received: from kroah.org ([198.145.64.141]:59686 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759706AbZFIKPf (ORCPT ); Tue, 9 Jun 2009 06:15:35 -0400 X-Mailbox-Line: From greg@blue.kroah.org Tue Jun 9 02:40:53 2009 Message-Id: <20090609094052.993171749@blue.kroah.org> User-Agent: quilt/0.48-1 Date: Tue, 09 Jun 2009 02:38:52 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Thomas Chenault , "David S. Miller" , Greg Kroah-Hartman Subject: [patch 04/87] net: fix skb_seq_read returning wrong offset/length for page frag data References: <20090609093848.204935043@blue.kroah.org> Content-Disposition: inline; filename=net-fix-skb_seq_read-returning-wrong-offset-length-for-page-frag-data.patch In-Reply-To: <20090609094451.GA26439@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1352 Lines: 29 2.6.29-stable review patch. If anyone has any objections, please let us know. ------------------ From: Thomas Chenault [ Upstream commit 995b337952cdf7e05d288eede580257b632a8343 ] When called with a consumed value that is less than skb_headlen(skb) bytes into a page frag, skb_seq_read() incorrectly returns an offset/length relative to skb->data. Ensure that data which should come from a page frag does. Signed-off-by: Thomas Chenault Tested-by: Shyam Iyer Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/skbuff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2206,7 +2206,7 @@ unsigned int skb_seq_read(unsigned int c next_skb: block_limit = skb_headlen(st->cur_skb) + st->stepped_offset; - if (abs_offset < block_limit) { + if (abs_offset < block_limit && !st->frag_data) { *data = st->cur_skb->data + (abs_offset - st->stepped_offset); return block_limit - abs_offset; } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/