* [PATCH 2/2] bonding: COW before overwriting the destination MAC address
@ 2011-03-03 4:25 Changli Gao
2011-03-03 6:45 ` Eric Dumazet
0 siblings, 1 reply; 3+ messages in thread
From: Changli Gao @ 2011-03-03 4:25 UTC (permalink / raw)
To: Jay Vosburgh; +Cc: David S. Miller, netdev, Changli Gao
When there is a ptype handler holding a clone of this skb, whose
destination MAC addresse is overwritten, the owner of this handler may
get a corrupted packet.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
---
drivers/net/bonding/bond_main.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 912b416..211be52 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1513,6 +1513,11 @@ static struct sk_buff *bond_handle_frame(struct sk_buff *skb)
skb->pkt_type == PACKET_HOST) {
u16 *dest = (u16 *) eth_hdr(skb)->h_dest;
+ if (unlikely(skb_cow_head(skb,
+ skb->data - skb_mac_header(skb)))) {
+ kfree_skb(skb);
+ return NULL;
+ }
memcpy(dest, bond_dev->dev_addr, ETH_ALEN);
}
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH 2/2] bonding: COW before overwriting the destination MAC address
2011-03-03 4:25 [PATCH 2/2] bonding: COW before overwriting the destination MAC address Changli Gao
@ 2011-03-03 6:45 ` Eric Dumazet
2011-03-03 6:54 ` Changli Gao
0 siblings, 1 reply; 3+ messages in thread
From: Eric Dumazet @ 2011-03-03 6:45 UTC (permalink / raw)
To: Changli Gao; +Cc: Jay Vosburgh, David S. Miller, netdev
Le jeudi 03 mars 2011 à 12:25 +0800, Changli Gao a écrit :
> When there is a ptype handler holding a clone of this skb, whose
> destination MAC addresse is overwritten, the owner of this handler may
> get a corrupted packet.
>
> Signed-off-by: Changli Gao <xiaosuo@gmail.com>
> ---
> drivers/net/bonding/bond_main.c | 5 +++++
> 1 file changed, 5 insertions(+)
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index 912b416..211be52 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -1513,6 +1513,11 @@ static struct sk_buff *bond_handle_frame(struct sk_buff *skb)
> skb->pkt_type == PACKET_HOST) {
> u16 *dest = (u16 *) eth_hdr(skb)->h_dest;
>
> + if (unlikely(skb_cow_head(skb,
> + skb->data - skb_mac_header(skb)))) {
> + kfree_skb(skb);
> + return NULL;
> + }
> memcpy(dest, bond_dev->dev_addr, ETH_ALEN);
> }
>
This seems buggy.
dest points to old skb head content.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH 2/2] bonding: COW before overwriting the destination MAC address
2011-03-03 6:45 ` Eric Dumazet
@ 2011-03-03 6:54 ` Changli Gao
0 siblings, 0 replies; 3+ messages in thread
From: Changli Gao @ 2011-03-03 6:54 UTC (permalink / raw)
To: Eric Dumazet; +Cc: Jay Vosburgh, David S. Miller, netdev
On Thu, Mar 3, 2011 at 2:45 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> Le jeudi 03 mars 2011 à 12:25 +0800, Changli Gao a écrit :
>> When there is a ptype handler holding a clone of this skb, whose
>> destination MAC addresse is overwritten, the owner of this handler may
>> get a corrupted packet.
>>
>> Signed-off-by: Changli Gao <xiaosuo@gmail.com>
>> ---
>> drivers/net/bonding/bond_main.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
>> index 912b416..211be52 100644
>> --- a/drivers/net/bonding/bond_main.c
>> +++ b/drivers/net/bonding/bond_main.c
>> @@ -1513,6 +1513,11 @@ static struct sk_buff *bond_handle_frame(struct sk_buff *skb)
>> skb->pkt_type == PACKET_HOST) {
>> u16 *dest = (u16 *) eth_hdr(skb)->h_dest;
>>
>> + if (unlikely(skb_cow_head(skb,
>> + skb->data - skb_mac_header(skb)))) {
>> + kfree_skb(skb);
>> + return NULL;
>> + }
>> memcpy(dest, bond_dev->dev_addr, ETH_ALEN);
>> }
>>
>
> This seems buggy.
>
> dest points to old skb head content.
>
>
Oh, thanks. I'll respin it.
--
Regards,
Changli Gao(xiaosuo@gmail.com)
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-03-03 6:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-03 4:25 [PATCH 2/2] bonding: COW before overwriting the destination MAC address Changli Gao
2011-03-03 6:45 ` Eric Dumazet
2011-03-03 6:54 ` Changli Gao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).