Re: libipq, kernel panics/oopses, and other undesirable traits

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 817 bytes --]

Matt Walters wrote:

>On Mon, 2004-08-16 at 15:38, Patrick McHardy wrote:
>
>>skb_tailroom should return 0 in this case and the skb should be linearized
>>by skb_copy_expand already. The check isn't triggered because this line is
>>wrong:
>>
>>diff = v->data_len - e->skb->len
>>
>>skb->len is the total length, including fragments. If we want to copy to it,
>>we either need to linearize it or look at skb_headlen(skb). It's complicated
>>getting everything right, I need to think about it some more.
>>    
>>

This patch on top of the ip_queue_nonlinear_skbs patch should fix the 
problem.
It wastes a couple of bytes when enlarging a non-linear skb, but that 
shouldn't be
a problem. When you test it, please try all three possibilities (replace 
by smaller,
equally sized and larger packet).

Regards
Patrick




[-- Attachment #2: x --]
[-- Type: text/plain, Size: 401 bytes --]

===== net/ipv4/netfilter/ip_queue.c 1.16 vs edited =====
--- 1.16/net/ipv4/netfilter/ip_queue.c	2004-01-29 00:59:33 +01:00
+++ edited/net/ipv4/netfilter/ip_queue.c	2004-08-17 12:35:05 +02:00
@@ -362,6 +362,8 @@
 		}
 		skb_put(e->skb, diff);
 	}
+	if (!skb_ip_make_writable(&e->skb, v->data_len))
+		return -ENOMEM;
 	memcpy(e->skb->data, v->payload, v->data_len);
 	e->skb->nfcache |= NFC_ALTERED;