[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 3 Mar 2011 14:54:36 +0800
From: Changli Gao <xiaosuo@...il.com>
To: Eric Dumazet <eric.dumazet@...il.com>
Cc: Jay Vosburgh <fubar@...ibm.com>,
"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH 2/2] bonding: COW before overwriting the destination MAC address
On Thu, Mar 3, 2011 at 2:45 PM, Eric Dumazet <eric.dumazet@...il.com> wrote:
> Le jeudi 03 mars 2011 à 12:25 +0800, Changli Gao a écrit :
>> When there is a ptype handler holding a clone of this skb, whose
>> destination MAC addresse is overwritten, the owner of this handler may
>> get a corrupted packet.
>>
>> Signed-off-by: Changli Gao <xiaosuo@...il.com>
>> ---
>> drivers/net/bonding/bond_main.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
>> index 912b416..211be52 100644
>> --- a/drivers/net/bonding/bond_main.c
>> +++ b/drivers/net/bonding/bond_main.c
>> @@ -1513,6 +1513,11 @@ static struct sk_buff *bond_handle_frame(struct sk_buff *skb)
>> skb->pkt_type == PACKET_HOST) {
>> u16 *dest = (u16 *) eth_hdr(skb)->h_dest;
>>
>> + if (unlikely(skb_cow_head(skb,
>> + skb->data - skb_mac_header(skb)))) {
>> + kfree_skb(skb);
>> + return NULL;
>> + }
>> memcpy(dest, bond_dev->dev_addr, ETH_ALEN);
>> }
>>
>
> This seems buggy.
>
> dest points to old skb head content.
>
>
Oh, thanks. I'll respin it.
--
Regards,
Changli Gao(xiaosuo@...il.com)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists