Attachment 146377 Details for Bug 223505 – [PACKET]: Fix skb->cb clobbering between aux and sockaddr

[patch] [PACKET]: Fix skb->cb clobbering between aux and sockaddr

p (text/plain), 2.83 KB, created by Herbert Xu on 2007-01-23 23:46:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Herbert Xu

Created: 2007-01-23 23:46:40 UTC

Size: 2.83 KB

patch

obsolete

>diff -ur linux-2.6.18.noarch.orig/net/packet/af_packet.c linux-2.6.18.noarch/net/packet/af_packet.c
>--- linux-2.6.18.noarch.orig/net/packet/af_packet.c	2007-01-12 13:58:59.000000000 +1100
>+++ linux-2.6.18.noarch/net/packet/af_packet.c	2007-01-24 10:15:59.000000000 +1100
>@@ -60,6 +60,7 @@
> #include <linux/netdevice.h>
> #include <linux/if_packet.h>
> #include <linux/wireless.h>
>+#include <linux/kernel.h>
> #include <linux/kmod.h>
> #include <net/ip.h>
> #include <net/protocol.h>
>@@ -214,7 +215,15 @@
> #endif
> };
> 
>-#define PACKET_SKB_CB(__skb)	((struct tpacket_auxdata *)((__skb)->cb))
>+struct packet_skb_cb {
>+	unsigned int origlen;
>+	union {
>+		struct sockaddr_pkt pkt;
>+		struct sockaddr_ll ll;
>+	} sa;
>+};
>+
>+#define PACKET_SKB_CB(__skb)	((struct packet_skb_cb *)((__skb)->cb))
> 
> extern int skb_checksum_setup(struct sk_buff *skb);
> 
>@@ -297,7 +306,7 @@
> 	/* drop conntrack reference */
> 	nf_reset(skb);
> 
>-	spkt = (struct sockaddr_pkt*)skb->cb;
>+	spkt = &PACKET_SKB_CB(skb)->sa.pkt;
> 
> 	skb_push(skb, skb->data-skb->mac.raw);
> 
>@@ -469,7 +478,6 @@
> 	u8 * skb_head = skb->data;
> 	int skb_len = skb->len;
> 	unsigned snaplen;
>-	struct tpacket_auxdata *aux;
> 
> 	if (skb->pkt_type == PACKET_LOOPBACK)
> 		goto drop;
>@@ -522,7 +530,10 @@
> 		skb = nskb;
> 	}
> 
>-	sll = (struct sockaddr_ll*)skb->cb;
>+	BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 >
>+		     sizeof(skb->cb));
>+
>+	sll = &PACKET_SKB_CB(skb)->sa.ll;
> 	sll->sll_family = AF_PACKET;
> 	sll->sll_hatype = dev->type;
> 	sll->sll_protocol = skb->protocol;
>@@ -536,14 +547,7 @@
> 	if (skb_checksum_setup(skb))
> 		goto drop_n_acct;
> 
>-	aux = PACKET_SKB_CB(skb);
>-	aux->tp_status = TP_STATUS_USER;
>-	if (skb->ip_summed == CHECKSUM_HW)
>-		aux->tp_status |= TP_STATUS_CSUMNOTREADY;
>-	aux->tp_len = skb->len;
>-	aux->tp_snaplen = snaplen;
>-	aux->tp_mac = 0;
>-	aux->tp_net = skb->nh.raw - skb->data;
>+	PACKET_SKB_CB(skb)->origlen = skb->len;
> 
> 	if (pskb_trim(skb, snaplen))
> 		goto drop_n_acct;
>@@ -1118,7 +1122,7 @@
> 	 *	it in now.
> 	 */
> 
>-	sll = (struct sockaddr_ll*)skb->cb;
>+	sll = &PACKET_SKB_CB(skb)->sa.ll;
> 	if (sock->type == SOCK_PACKET)
> 		msg->msg_namelen = sizeof(struct sockaddr_pkt);
> 	else
>@@ -1143,11 +1147,21 @@
> 	sock_recv_timestamp(msg, sk, skb);
> 
> 	if (msg->msg_name)
>-		memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
>+		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
>+		       msg->msg_namelen);
> 
> 	if (pkt_sk(sk)->auxdata) {
>-		struct tpacket_auxdata *aux = PACKET_SKB_CB(skb);
>-		put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(*aux), aux);
>+		struct tpacket_auxdata aux;
>+
>+		aux.tp_status = TP_STATUS_USER;
>+		if (skb->ip_summed == CHECKSUM_HW)
>+			aux.tp_status |= TP_STATUS_CSUMNOTREADY;
>+		aux.tp_len = PACKET_SKB_CB(skb)->origlen;
>+		aux.tp_snaplen = skb->len;
>+		aux.tp_mac = 0;
>+		aux.tp_net = skb->nh.raw - skb->data;
>+
>+		put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
> 	}
> 
> 	/*

Actions: View | Diff

Attachments on bug 223505: 146320 | 146377