Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756316Ab0LLXyr (ORCPT ); Sun, 12 Dec 2010 18:54:47 -0500 Received: from one.firstfloor.org ([213.235.205.2]:36748 "EHLO one.firstfloor.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755975Ab0LLXsT (ORCPT ); Sun, 12 Dec 2010 18:48:19 -0500 From: Andi Kleen References: <201012131244.547034648@firstfloor.org> In-Reply-To: <201012131244.547034648@firstfloor.org> To: lindner_marek@yahoo.de, sven.eckelmann@gmx.de, gregkh@suse.de, ak@linux.intel.com, linux-kernel@vger.kernel.org, stable@kernel.org Subject: [PATCH] [192/223] Staging: batman-adv: ensure that eth_type_trans gets linear memory Message-Id: <20101212234818.3379BB27BF@basil.firstfloor.org> Date: Mon, 13 Dec 2010 00:48:18 +0100 (CET) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1826 Lines: 48 2.6.35-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Marek Lindner commit b6faaae1a15a352d68b3e3cd8b840e56709820bf upstream. eth_type_trans tries to pull data with the length of the ethernet header from the skb. We only ensured that enough data for the first ethernet header and the batman header is available in non-paged memory of the skb and not for the ethernet after the batman header. eth_type_trans would fail sometimes with drivers which don't ensure that all there data is perfectly linearised. The failure was noticed through a kernel bug Oops generated by the skb_pull inside eth_type_trans. Reported-by: Rafal Lesniak Signed-off-by: Marek Lindner Signed-off-by: Sven Eckelmann Signed-off-by: Greg Kroah-Hartman Signed-off-by: Andi Kleen --- drivers/staging/batman-adv/soft-interface.c | 4 ++++ 1 file changed, 4 insertions(+) Index: linux/drivers/staging/batman-adv/soft-interface.c =================================================================== --- linux.orig/drivers/staging/batman-adv/soft-interface.c +++ linux/drivers/staging/batman-adv/soft-interface.c @@ -295,6 +295,10 @@ void interface_rx(struct sk_buff *skb, i skb_pull_rcsum(skb, hdr_size); /* skb_set_mac_header(skb, -sizeof(struct ethhdr));*/ + if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) { + kfree_skb(skb); + return; + } skb->dev = dev; skb->protocol = eth_type_trans(skb, dev); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/