OpenVZ Forum: Devel » [PATCH] Copy mac_len in skb

Home » Mailing lists » Devel » [PATCH] Copy mac_len in skb_clone() as well

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: [PATCH] Copy mac_len in skb_clone() as well [message #11224 is a reply to message #11195]

Thu, 15 March 2007 16:04

Alexey Kuznetsov
Messages: 18
Registered: February 2006

Junior Member

Hello!

> What bug triggered that helped you discover this? Or is it
> merely from a code audit?

I asked the same question. :-)

openvz added some another fields to skbuff and when it was found
that they are lost while clone, he tried to figure out how all this works
and looked for another examples of this kind.

As I understand, the problem can be seen only in xfrmX_tunnel_input.
If uninitialized mac_len obtained from slab is more than current head room
it could corrupt memory.

Also, it looks like the fix is incomplete. copy_skb_header() also does not
copy this field. But it will be initialized to 0 by alloc_skb in this case
and xfrmX_tunnel_input() just will not copy mac header.

Alexey

Report message to a moderator

[Message index]

		[PATCH] Copy mac_len in skb_clone() as well By: Alexey Dobriyan on Wed, 14 March 2007 13:00
		Re: [PATCH] Copy mac_len in skb_clone() as well By: davem on Thu, 15 March 2007 10:02
		Re: Re: [PATCH] Copy mac_len in skb_clone() as well By: dev on Thu, 15 March 2007 10:19
		Re: Re: [PATCH] Copy mac_len in skb_clone() as well By: davem on Fri, 16 March 2007 01:08
		Re: [PATCH] Copy mac_len in skb_clone() as well By: Alexey Kuznetsov on Thu, 15 March 2007 16:04

Previous Topic:	[PATCH 1/2] mm: move common segment checks to separate helper function (v6)
Next Topic:	Monitoring /proc/user_beancounters via Perl Script?

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Sat Jul 05 12:33:09 GMT 2025

Total time taken to generate the page: 0.02092 seconds