netdev - [patch for 2.6.26? 1/2] wan: add missing skb->dev assignment in Frame Relay RX code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 03 Jul 2008 23:54:54 -0700
From:	akpm@...ux-foundation.org
To:	jeff@...zik.org
Cc:	netdev@...r.kernel.org, akpm@...ux-foundation.org, khc@...waw.pl,
	acme@...hat.com, davem@...emloft.net,
	shemminger@...uxfoundation.org, stable@...nel.org
Subject: [patch for 2.6.26? 1/2] wan: add missing skb->dev assignment in Frame Relay RX code

From: Krzysztof Halasa <khc@...waw.pl>

Commit 4c13eb6657fe9ef7b4dc8f1a405c902e9e5234e0 ([ETH]: Make
eth_type_trans set skb->dev like the other *_type_trans) removed skb->dev
assignment from hdlc_fr.c:fr_rx().  Unfortunately it was also needed for
cases other than eth_type_trans().

Add it back.

It's quite serious and may be a security risk as it causes a wrong input
interface indication (the physical hdlcX instead of logical pvcX). 
Probably -stable class fix.

Signed-off-by: Krzysztof Halasa <khc@...waw.pl>
Cc: Jeff Garzik <jeff@...zik.org>
Cc: "David S. Miller" <davem@...emloft.net>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: Stephen Hemminger <shemminger@...l.org>
Cc: <stable@...nel.org>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 drivers/net/wan/hdlc_fr.c |    1 +
 1 file changed, 1 insertion(+)

diff -puN drivers/net/wan/hdlc_fr.c~wan-add-missing-skb-dev-assignment-in-frame-relay-rx-code drivers/net/wan/hdlc_fr.c
--- a/drivers/net/wan/hdlc_fr.c~wan-add-missing-skb-dev-assignment-in-frame-relay-rx-code
+++ a/drivers/net/wan/hdlc_fr.c
@@ -1008,6 +1008,7 @@ static int fr_rx(struct sk_buff *skb)
 		stats->rx_bytes += skb->len;
 		if (pvc->state.becn)
 			stats->rx_compressed++;
+		skb->dev = dev;
 		netif_rx(skb);
 		return NET_RX_SUCCESS;
 	} else {
_
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html