diff for duplicates of <4C2D53D3.6050106@linux-ipv6.org> diff --git a/a/1.txt b/N1/1.txt index 6baad7a..27d3eb0 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -61,12 +61,4 @@ do_IRQ()->do_softirq()->__do_softirq()->net_rx_action()->ubi32_eth_napi_poll()-> The packet is then dequeued by: do_IRQ() -> irq_exit() -> do_softirq() -> run_timer_softirq() -> neigh_timer_handler() -> arp_error_report() -> ipv4_link_failure() -> icmp_send() -> ip_options_echo(). -Because the Ubicom Ethernet driver overwrites the common buffer area, the enqueued packet contains garbage when casted as an IP options data structure. This results in ip_options_echo() miss reading the option length information and overwriting memory. By clearing the skb->cb[] before processing the icmp_send() against the packet, we ensure that ip_options_echo() does not corrupt memory. - - - --- -To unsubscribe from this list: send the line "unsubscribe linux-kernel" in -the body of a message to majordomo@vger.kernel.org -More majordomo info at http://vger.kernel.org/majordomo-info.html -Please read the FAQ at http://www.tux.org/lkml/ +Because the Ubicom Ethernet driver overwrites the common buffer area, the enqueued packet contains garbage when casted as an IP options data structure. This results in ip_options_echo() miss reading the option length information and overwriting memory. By clearing the skb->cb[] before processing the icmp_send() against the packet, we ensure that ip_options_echo() does not corrupt memory. diff --git a/a/content_digest b/N1/content_digest index 09ec40f..52c341c 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -68,14 +68,6 @@ "The packet is then dequeued by: \n" "do_IRQ() -> irq_exit() -> do_softirq() -> run_timer_softirq() -> neigh_timer_handler() -> arp_error_report() -> ipv4_link_failure() -> icmp_send() -> ip_options_echo().\n" "\n" - "Because the Ubicom Ethernet driver overwrites the common buffer area, the enqueued packet contains garbage when casted as an IP options data structure. This results in ip_options_echo() miss reading the option length information and overwriting memory. By clearing the skb->cb[] before processing the icmp_send() against the packet, we ensure that ip_options_echo() does not corrupt memory. \n" - "\n" - "\n" - "\n" - "--\n" - "To unsubscribe from this list: send the line \"unsubscribe linux-kernel\" in\n" - "the body of a message to majordomo@vger.kernel.org\n" - "More majordomo info at http://vger.kernel.org/majordomo-info.html\n" - Please read the FAQ at http://www.tux.org/lkml/ + Because the Ubicom Ethernet driver overwrites the common buffer area, the enqueued packet contains garbage when casted as an IP options data structure. This results in ip_options_echo() miss reading the option length information and overwriting memory. By clearing the skb->cb[] before processing the icmp_send() against the packet, we ensure that ip_options_echo() does not corrupt memory. -c3981bbbba7f6082a02c3452d02f854455623c772687dc31a70f028f82fa7800 +e22dee5585cb00405d93238bf0ff89a08ef327dc43685bc908891d56e65676ab
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.