stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, David Oostdyk <daveo@ll.mit.edu>,
	Eric Dumazet <edumazet@google.com>,
	Ed Cashin <ecashin@coraid.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [ 59/68] aoe: reserve enough headroom on skbs
Date: Tue,  2 Apr 2013 15:13:48 -0700	[thread overview]
Message-ID: <20130402221336.795124330@linuxfoundation.org> (raw)
In-Reply-To: <20130402221329.915209206@linuxfoundation.org>

3.4-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 91c5746425aed8f7188a351f1224a26aa232e4b3 ]

Some network drivers use a non default hard_header_len

Transmitted skb should take into account dev->hard_header_len, or risk
crashes or expensive reallocations.

In the case of aoe, lets reserve MAX_HEADER bytes.

David reported a crash in defxx driver, solved by this patch.

Reported-by: David Oostdyk <daveo@ll.mit.edu>
Tested-by: David Oostdyk <daveo@ll.mit.edu>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ed Cashin <ecashin@coraid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/aoe/aoecmd.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -30,8 +30,9 @@ new_skb(ulong len)
 {
 	struct sk_buff *skb;
 
-	skb = alloc_skb(len, GFP_ATOMIC);
+	skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC);
 	if (skb) {
+		skb_reserve(skb, MAX_HEADER);
 		skb_reset_mac_header(skb);
 		skb_reset_network_header(skb);
 		skb->protocol = __constant_htons(ETH_P_AOE);



  parent reply	other threads:[~2013-04-02 22:13 UTC|newest]

Thread overview: 71+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-04-02 22:12 [ 00/68] 3.4.39-stable review Greg Kroah-Hartman
2013-04-02 22:12 ` [ 01/68] signal: Define __ARCH_HAS_SA_RESTORER so we know whether to clear sa_restorer Greg Kroah-Hartman
2013-04-02 22:12 ` [ 02/68] kernel/signal.c: use __ARCH_HAS_SA_RESTORER instead of SA_RESTORER Greg Kroah-Hartman
2013-04-02 22:12 ` [ 03/68] SUNRPC: Add barriers to ensure read ordering in rpc_wake_up_task_queue_locked Greg Kroah-Hartman
2013-04-02 22:12 ` [ 04/68] tile: expect new initramfs name from hypervisor file system Greg Kroah-Hartman
2013-04-02 22:12 ` [ 05/68] Bluetooth: Fix not closing SCO sockets in the BT_CONNECT2 state Greg Kroah-Hartman
2013-04-02 22:12 ` [ 06/68] Bluetooth: Add support for Dell[QCA 0cf3:0036] Greg Kroah-Hartman
2013-04-02 22:12 ` [ 07/68] Bluetooth: Add support for Dell[QCA 0cf3:817a] Greg Kroah-Hartman
2013-04-02 22:12 ` [ 08/68] staging: comedi: s626: fix continuous acquisition Greg Kroah-Hartman
2013-04-02 22:12 ` [ 09/68] sysfs: fix race between readdir and lseek Greg Kroah-Hartman
2013-04-02 22:12 ` [ 10/68] sysfs: handle failure path correctly for readdir() Greg Kroah-Hartman
2013-04-02 22:13 ` [ 11/68] can: sja1000: fix define conflict on SH Greg Kroah-Hartman
2013-04-02 22:13 ` [ 12/68] ath9k_hw: revert chainmask to user configuration after calibration Greg Kroah-Hartman
2013-04-02 22:13 ` [ 13/68] HID: usbhid: quirk for Realtek Multi-card reader Greg Kroah-Hartman
2013-04-02 22:13 ` [ 14/68] rtlwifi: usb: add missing freeing of skbuff Greg Kroah-Hartman
2013-04-02 22:13 ` [ 15/68] b43: N-PHY: increase initial value of "mind" in RSSI calibration Greg Kroah-Hartman
2013-04-02 22:13 ` [ 16/68] b43: A fix for DMA transmission sequence errors Greg Kroah-Hartman
2013-04-02 22:13 ` [ 17/68] b43: N-PHY: use more bits for offset in RSSI calibration Greg Kroah-Hartman
2013-04-02 22:13 ` [ 18/68] tg3: fix length overflow in VPD firmware parsing Greg Kroah-Hartman
2013-04-02 22:13 ` [ 19/68] iommu/amd: Make sure dma_ops are set for hotplug devices Greg Kroah-Hartman
2013-04-02 22:13 ` [ 20/68] xen/blkback: correctly respond to unknown, non-native requests Greg Kroah-Hartman
2013-04-02 22:13 ` [ 21/68] xen-blkback: fix dispatch_rw_block_io() error path Greg Kroah-Hartman
2013-04-02 22:13 ` [ 22/68] tty: atmel_serial_probe(): index of atmel_ports[] fix Greg Kroah-Hartman
2013-04-02 22:13 ` [ 23/68] usb: ftdi_sio: Add support for Mitsubishi FX-USB-AW/-BD Greg Kroah-Hartman
2013-04-02 22:13 ` [ 24/68] vt: synchronize_rcu() under spinlock is not nice Greg Kroah-Hartman
2013-04-02 22:13 ` [ 25/68] mwifiex: cancel cmd timer and free curr_cmd in shutdown process Greg Kroah-Hartman
2013-04-08 18:01   ` Bing Zhao
2013-04-02 22:13 ` [ 26/68] pnfs-block: removing DM device maybe cause oops when call dev_remove Greg Kroah-Hartman
2013-04-02 22:13 ` [ 27/68] net/irda: add missing error path release_sock call Greg Kroah-Hartman
2013-04-02 22:13 ` [ 28/68] usb: xhci: Fix TRB transfer length macro used for Event TRB Greg Kroah-Hartman
2013-04-02 22:13 ` [ 29/68] Btrfs: fix race between mmap writes and compression Greg Kroah-Hartman
2013-04-02 22:13 ` [ 30/68] Btrfs: limit the global reserve to 512mb Greg Kroah-Hartman
2013-04-02 22:13 ` [ 31/68] Btrfs: dont drop path when printing out tree errors in scrub Greg Kroah-Hartman
2013-04-02 22:13 ` [ 32/68] usb: gadget: udc-core: fix a regression during gadget driver unbinding Greg Kroah-Hartman
2013-04-02 22:13 ` [ 33/68] loop: prevent bdev freeing while device in use Greg Kroah-Hartman
2013-04-02 22:13 ` [ 34/68] ARM: cns3xxx: fix mapping of private memory region Greg Kroah-Hartman
2013-04-02 22:13 ` [ 35/68] nfsd4: reject "negative" acl lengths Greg Kroah-Hartman
2013-04-02 22:13 ` [ 36/68] drm/i915: Dont clobber crtc->fb when queue_flip fails Greg Kroah-Hartman
2013-04-02 22:13 ` [ 37/68] Btrfs: fix space leak when we fail to reserve metadata space Greg Kroah-Hartman
2013-04-02 22:13 ` [ 38/68] efivars: explicitly calculate length of VariableName Greg Kroah-Hartman
2013-04-02 22:13 ` [ 39/68] efivars: Handle duplicate names from get_next_variable() Greg Kroah-Hartman
2013-04-02 22:13 ` [ 40/68] ext4: convert number of blocks to clusters properly Greg Kroah-Hartman
2013-04-02 22:13 ` [ 41/68] ext4: use atomic64_t for the per-flexbg free_clusters count Greg Kroah-Hartman
2013-04-02 22:13 ` [ 42/68] tracing: Protect tracer flags with trace_types_lock Greg Kroah-Hartman
2013-04-02 22:13 ` [ 43/68] tracing: Prevent buffer overwrite disabled for latency tracers Greg Kroah-Hartman
2013-04-02 22:13 ` [ 44/68] net: remove a WARN_ON() in net_enable_timestamp() Greg Kroah-Hartman
2013-04-02 22:13 ` [ 45/68] sky2: Receive Overflows not counted Greg Kroah-Hartman
2013-04-02 22:13 ` [ 46/68] sky2: Threshold for Pause Packet is set wrong Greg Kroah-Hartman
2013-04-02 22:13 ` [ 47/68] tcp: preserve ACK clocking in TSO Greg Kroah-Hartman
2013-04-02 22:13 ` [ 48/68] tcp: undo spurious timeout after SACK reneging Greg Kroah-Hartman
2013-04-02 22:13 ` [ 49/68] 8021q: fix a potential use-after-free Greg Kroah-Hartman
2013-04-02 22:13 ` [ 50/68] thermal: shorten too long mcast group name Greg Kroah-Hartman
2013-04-02 22:13 ` [ 51/68] unix: fix a race condition in unix_release() Greg Kroah-Hartman
2013-04-02 22:13 ` [ 52/68] af_unix: dont send SCM_CREDENTIAL when dest socket is NULL Greg Kroah-Hartman
2013-04-02 22:13 ` [ 53/68] bonding: remove already created master sysfs link on failure Greg Kroah-Hartman
2013-04-02 22:13 ` [ 54/68] bonding: fix miimon and arp_interval delayed work race conditions Greg Kroah-Hartman
2013-04-02 22:13 ` [ 55/68] bonding: fix disabling of arp_interval and miimon Greg Kroah-Hartman
2013-04-02 22:13 ` [ 56/68] drivers: net: ethernet: davinci_emac: use netif_wake_queue() while restarting tx queue Greg Kroah-Hartman
2013-04-02 22:13 ` [ 57/68] drivers: net: ethernet: cpsw: " Greg Kroah-Hartman
2013-04-02 22:13 ` [ 58/68] net: fix *_DIAG_MAX constants Greg Kroah-Hartman
2013-04-02 22:13 ` Greg Kroah-Hartman [this message]
2013-04-02 22:13 ` [ 60/68] atl1e: drop pci-msi support because of packet corruption Greg Kroah-Hartman
2013-04-02 22:13 ` [ 61/68] DM9000B: driver initialization upgrade Greg Kroah-Hartman
2013-04-02 22:13 ` [ 62/68] ipv6: dont accept multicast traffic with scope 0 Greg Kroah-Hartman
2013-04-02 22:13 ` [ 63/68] ipv6: fix bad free of addrconf_init_net Greg Kroah-Hartman
2013-04-02 22:13 ` [ 64/68] ipv6: dont accept node local multicast traffic from the wire Greg Kroah-Hartman
2013-04-02 22:13 ` [ 65/68] ks8851: Fix interpretation of rxlen field Greg Kroah-Hartman
2013-04-02 22:13 ` [ 66/68] net: add a synchronize_net() in netdev_rx_handler_unregister() Greg Kroah-Hartman
2013-04-02 22:13 ` [ 67/68] pch_gbe: fix ip_summed checksum reporting on rx Greg Kroah-Hartman
2013-04-02 22:13 ` [ 68/68] smsc75xx: fix jumbo frame support Greg Kroah-Hartman
2013-04-03 15:19 ` [ 00/68] 3.4.39-stable review Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130402221336.795124330@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=daveo@ll.mit.edu \
    --cc=ecashin@coraid.com \
    --cc=edumazet@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).