From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
alan@lxorguk.ukuu.org.uk,
Ramesh Nagappa <ramesh.nagappa@ericsson.com>,
Shawn Lu <shawn.lu@ericsson.com>,
Robert Coulson <robert.coulson@ericsson.com>,
Billie Alsup <billie.alsup@ericsson.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [ 19/31] net: Fix skb_under_panic oops in neigh_resolve_output
Date: Thu, 25 Oct 2012 17:04:26 -0700 [thread overview]
Message-ID: <20121026000216.906164171@linuxfoundation.org> (raw)
In-Reply-To: <20121026000214.941721299@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: "ramesh.nagappa@gmail.com" <ramesh.nagappa@gmail.com>
[ Upstream commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c ]
The retry loop in neigh_resolve_output() and neigh_connected_output()
call dev_hard_header() with out reseting the skb to network_header.
This causes the retry to fail with skb_under_panic. The fix is to
reset the network_header within the retry loop.
Signed-off-by: Ramesh Nagappa <ramesh.nagappa@ericsson.com>
Reviewed-by: Shawn Lu <shawn.lu@ericsson.com>
Reviewed-by: Robert Coulson <robert.coulson@ericsson.com>
Reviewed-by: Billie Alsup <billie.alsup@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/neighbour.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1313,8 +1313,6 @@ int neigh_resolve_output(struct sk_buff
if (!dst)
goto discard;
- __skb_pull(skb, skb_network_offset(skb));
-
if (!neigh_event_send(neigh, skb)) {
int err;
struct net_device *dev = neigh->dev;
@@ -1326,6 +1324,7 @@ int neigh_resolve_output(struct sk_buff
neigh_hh_init(neigh, dst, dst->ops->protocol);
do {
+ __skb_pull(skb, skb_network_offset(skb));
seq = read_seqbegin(&neigh->ha_lock);
err = dev_hard_header(skb, dev, ntohs(skb->protocol),
neigh->ha, NULL, skb->len);
@@ -1358,9 +1357,8 @@ int neigh_connected_output(struct sk_buf
struct net_device *dev = neigh->dev;
unsigned int seq;
- __skb_pull(skb, skb_network_offset(skb));
-
do {
+ __skb_pull(skb, skb_network_offset(skb));
seq = read_seqbegin(&neigh->ha_lock);
err = dev_hard_header(skb, dev, ntohs(skb->protocol),
neigh->ha, NULL, skb->len);
next prev parent reply other threads:[~2012-10-26 0:04 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-26 0:04 [ 00/31] 3.0.49-stable review Greg Kroah-Hartman
2012-10-26 0:04 ` [ 01/31] arch/tile: avoid generating .eh_frame information in modules Greg Kroah-Hartman
2012-10-26 0:04 ` [ 02/31] NLM: nlm_lookup_file() may return NLMv4-specific error codes Greg Kroah-Hartman
2012-10-26 0:04 ` [ 03/31] oprofile, x86: Fix wrapping bug in op_x86_get_ctrl() Greg Kroah-Hartman
2012-10-26 0:04 ` [ 04/31] SUNRPC: Prevent kernel stack corruption on long values of flush Greg Kroah-Hartman
2012-10-26 0:04 ` [ 05/31] Revert: lockd: use rpc clients cl_nodename for id encoding Greg Kroah-Hartman
2012-10-26 0:04 ` [ 06/31] pcmcia: sharpsl: dont discard sharpsl_pcmcia_ops Greg Kroah-Hartman
2012-10-26 0:04 ` [ 07/31] kernel/sys.c: fix stack memory content leak via UNAME26 Greg Kroah-Hartman
2012-10-26 0:04 ` [ 09/31] x86: Exclude E820_RESERVED regions and memory holes above 4 GB from direct mapping Greg Kroah-Hartman
2012-10-26 0:04 ` [ 10/31] xen/x86: dont corrupt %eip when returning from a signal handler Greg Kroah-Hartman
2012-10-26 0:04 ` [ 11/31] USB: cdc-acm: fix pipe type of write endpoint Greg Kroah-Hartman
2012-10-26 0:04 ` [ 12/31] usb: acm: fix the computation of the number of data bits Greg Kroah-Hartman
2012-10-26 0:04 ` [ 13/31] USB: option: blacklist net interface on ZTE devices Greg Kroah-Hartman
2012-10-26 0:04 ` [ 14/31] USB: option: add more " Greg Kroah-Hartman
2012-10-26 0:04 ` [ 15/31] cgroup: notify_on_release may not be triggered in some cases Greg Kroah-Hartman
2012-10-26 0:04 ` [ 16/31] amd64_edac:__amd64_set_scrub_rate(): avoid overindexing scrubrates[] Greg Kroah-Hartman
2012-10-26 0:04 ` [ 17/31] media: au0828: fix case where STREAMOFF being called on stopped stream causes BUG() Greg Kroah-Hartman
2012-10-26 0:04 ` [ 18/31] drm/i915: apply timing generator bug workaround on CPT and PPT Greg Kroah-Hartman
2012-10-26 0:04 ` Greg Kroah-Hartman [this message]
2012-10-26 0:04 ` [ 20/31] skge: Add DMA mask quirk for Marvell 88E8001 on ASUS P5NSLI motherboard Greg Kroah-Hartman
2012-10-26 0:04 ` [ 21/31] RDS: fix rds-ping spinlock recursion Greg Kroah-Hartman
2012-10-26 0:04 ` [ 22/31] tcp: resets are misrouted Greg Kroah-Hartman
2012-10-26 0:04 ` [ 23/31] sparc64: fix ptrace interaction with force_successful_syscall_return() Greg Kroah-Hartman
2012-10-26 0:04 ` [ 24/31] sparc64: Like x86 we should check current->mm during perf backtrace generation Greg Kroah-Hartman
2012-10-26 0:04 ` [ 25/31] sparc64: Fix bit twiddling in sparc_pmu_enable_event() Greg Kroah-Hartman
2012-10-26 0:04 ` [ 26/31] sparc64: do not clobber personality flags in sys_sparc64_personality() Greg Kroah-Hartman
2012-10-26 0:04 ` [ 27/31] sparc64: Be less verbose during vmemmap population Greg Kroah-Hartman
2012-10-26 0:04 ` [ 28/31] xHCI: add cmd_ring_state Greg Kroah-Hartman
2012-10-26 0:04 ` [ 29/31] xHCI: add aborting command ring function Greg Kroah-Hartman
2012-10-26 0:04 ` [ 30/31] xHCI: cancel command after command timeout Greg Kroah-Hartman
2012-10-26 0:04 ` [ 31/31] xHCI: handle command after aborting the command ring Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121026000216.906164171@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=billie.alsup@ericsson.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=ramesh.nagappa@ericsson.com \
--cc=robert.coulson@ericsson.com \
--cc=shawn.lu@ericsson.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).