Le jeudi 01 septembre 2011 à 16:21 +0400, Alexander Smirnov a écrit :
> This patch fixes 2 issues in lowpan_skb_deliver function:
> 1. Check for return status of skb_copy call;
> 2. Use skb_copy with proper GFP flag depending on context.
>
Reported-by: Eric Dumazet <eric.dumazet@xxxxxxxxx>
patch adds a new bug, see below
> Signed-off-by: Alexander Smirnov <alex.bluesman.smirnov@xxxxxxxxx>
> ---
> net/ieee802154/6lowpan.c | 18 +++++++++++++++---
> 1 files changed, 15 insertions(+), 3 deletions(-)
>
> diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
> index cf304cc..cac1361 100644
> --- a/net/ieee802154/6lowpan.c
> +++ b/net/ieee802154/6lowpan.c
> @@ -477,9 +477,15 @@ static int lowpan_skb_deliver(struct sk_buff *skb, struct ipv6hdr *hdr)
> struct sk_buff *new;
> struct lowpan_dev_record *entry;
> int stat = NET_RX_SUCCESS;
> + gfp_t mask;
>
> - new = skb_copy_expand(skb, sizeof(struct ipv6hdr), skb_tailroom(skb),
> - GFP_KERNEL);
> + if (in_interrupt())
> + mask = GFP_ATOMIC;
> + else
> + mask = GFP_KERNEL;
> +
> + new = skb_copy_expand(skb, sizeof(struct ipv6hdr),
> + skb_tailroom(skb), mask);
> kfree_skb(skb);
>
> if (NULL == new)
> @@ -495,7 +501,13 @@ static int lowpan_skb_deliver(struct sk_buff *skb, struct ipv6hdr *hdr)
> rcu_read_lock();
> list_for_each_entry_rcu(entry, &lowpan_devices, list)
> if (lowpan_dev_info(entry->ldev)->real_dev == new->dev) {
> - skb = skb_copy(new, GFP_KERNEL);
> + skb = skb_copy(new, mask);
> +
> + if (NULL == skb) {
> + kfree_skb(new);
rcu_read_unlock() missing.
just do :
stat = -ENOMEM;
break; (to exit from list_for_each_entry_rcu())
> + return -ENOMEM;
> + }
> +
> skb->dev = entry->ldev;
>
> if (in_interrupt())
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
