netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
To: netdev@vger.kernel.org, David Miller <davem@davemloft.net>,
	Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alexandre.bounine@idt.com>,
	Frank Kunz <frank.kunz@nokia.com>,
	Marek Krzyzowski <marek.krzyzowski@nokia.com>
Subject: [PATCH] rionet: Don't try to corrupt skbuff assigning data pointer directly
Date: Wed, 1 Jul 2015 15:01:11 +0200	[thread overview]
Message-ID: <5593E497.40804@nokia.com> (raw)

It's not allowed to assign data pointer of skbuff directly, this makes no sense
if the assigned pointer is the very same as already existing one, or it brakes
all the pointer arithmetics in all other cases. We cannot do better as just
compare them and report BUG() in case of mismatch.

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
---

We came across this problem developing new code for Octeon2 RAPIDIO. For the last
10 years since original commit of the code this assignment did nothing as the
pointers were always same. But the bug in the new code discovered this one. So
better do BUG() immediately here, this would prevent longer debugging of the
following skbuff corruption.

 drivers/net/rionet.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index dac7a0d..34c27b8 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -104,7 +104,8 @@ static int rionet_rx_clean(struct net_device *ndev)
 		if (!(data = rio_get_inb_message(rnet->mport, RIONET_MAILBOX)))
 			break;

-		rnet->rx_skb[i]->data = data;
+		if (rnet->rx_skb[i]->data != data)
+			BUG();
 		skb_put(rnet->rx_skb[i], RIO_MAX_MSG_SIZE);
 		rnet->rx_skb[i]->protocol =
 		    eth_type_trans(rnet->rx_skb[i], ndev);

             reply	other threads:[~2015-07-01 13:02 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-07-01 13:01 Alexander Sverdlin [this message]
2015-07-02 19:12 ` [PATCH] rionet: Don't try to corrupt skbuff assigning data pointer directly David Miller
2015-07-03  7:24   ` Alexander Sverdlin
2015-07-03  7:27     ` Krzyzowski, Marek (Nokia - DE/Ulm)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5593E497.40804@nokia.com \
    --to=alexander.sverdlin@nokia.com \
    --cc=alexandre.bounine@idt.com \
    --cc=davem@davemloft.net \
    --cc=frank.kunz@nokia.com \
    --cc=marek.krzyzowski@nokia.com \
    --cc=mporter@kernel.crashing.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).