From patchwork Mon Nov 22 11:34:48 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 580 Return-Path: Received: from mail.gmx.net (mailout-de.gmx.net [213.165.64.23]) by open-mesh.org (Postfix) with SMTP id 192BF1545A4 for ; Mon, 22 Nov 2010 12:35:14 +0100 (CET) Received: (qmail invoked by alias); 22 Nov 2010 11:35:13 -0000 Received: from camo157-92.hrz.tu-chemnitz.de (EHLO localhost) [134.109.157.92] by mail.gmx.net (mp043) with SMTP; 22 Nov 2010 12:35:13 +0100 X-Authenticated: #15668376 X-Provags-ID: V01U2FsdGVkX1+eh0tDxIyeV5lHf02fYTXwSTuSPOOpGjnfc2ApSe zsRMipUtHGwkIC From: Sven Eckelmann To: greg@kroah.com Date: Mon, 22 Nov 2010 12:34:48 +0100 Message-Id: <1290425690-5119-2-git-send-email-sven.eckelmann@gmx.de> X-Mailer: git-send-email 1.7.2.3 In-Reply-To: <201011221129.06220.sven.eckelmann@gmx.de> References: <201011221129.06220.sven.eckelmann@gmx.de> X-Y-GMX-Trusted: 0 Cc: b.a.t.m.a.n@lists.open-mesh.org, Marek Lindner , stable@kernel.org Subject: [B.A.T.M.A.N.] [PATCH-stable] Staging: batman-adv: ensure that eth_type_trans gets linear memory X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.11 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Nov 2010 11:35:16 -0000 From: Marek Lindner eth_type_trans tries to pull data with the length of the ethernet header from the skb. We only ensured that enough data for the first ethernet header and the batman header is available in non-paged memory of the skb and not for the ethernet after the batman header. eth_type_trans would fail sometimes with drivers which don't ensure that all there data is perfectly linearised. The failure was noticed through a kernel bug Oops generated by the skb_pull inside eth_type_trans. Reported-by: Rafal Lesniak Signed-off-by: Marek Lindner Signed-off-by: Sven Eckelmann Cc: stable@kernel.org --- This patch is the backport to v2.6.36 and was also submitted slightly different for 2.6.37 and 2.6.38. drivers/staging/batman-adv/soft-interface.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/drivers/staging/batman-adv/soft-interface.c b/drivers/staging/batman-adv/soft-interface.c index 2ea97de..876be5a 100644 --- a/drivers/staging/batman-adv/soft-interface.c +++ b/drivers/staging/batman-adv/soft-interface.c @@ -246,6 +246,10 @@ void interface_rx(struct sk_buff *skb, int hdr_size) skb_pull_rcsum(skb, hdr_size); /* skb_set_mac_header(skb, -sizeof(struct ethhdr));*/ + if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) { + kfree_skb(skb); + return; + } skb->dev = dev; skb->protocol = eth_type_trans(skb, dev);