blob: 603652578bd8e4d82b0fd0c17a3ee89bd6bc2b64 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
# HG changeset 152 patch
# User kfraser@localhost.localdomain
# Date 1185977806 -3600
# Node ID 8d5ae51a09a66ff450b46ebb09ff99475604ed91
# Parent 1372bc676080a527c98cd4de82637edd319794e7
Subject: [NET] netloop: Do not clobber cloned skb page frags
The netloop driver tries to localise foreign mappings by
copying them. Unfortunately, it does so by directly modifying
skb page frags without checking whether the skb is cloned or
not. In fact, the packet is going to be cloned more often
than not.
This may result in either data corruption on DMA or a
page fault in dom0 which kills the whole machine.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: jbeulich@novell.com
Index: head-2007-08-07/drivers/xen/netback/loopback.c
===================================================================
--- head-2007-08-07.orig/drivers/xen/netback/loopback.c 2007-08-07 09:47:09.000000000 +0200
+++ head-2007-08-07/drivers/xen/netback/loopback.c 2007-08-07 10:00:10.000000000 +0200
@@ -99,6 +99,10 @@ static int skb_remove_foreign_references
BUG_ON(skb_shinfo(skb)->frag_list);
+ if (skb_cloned(skb) &&
+ unlikely(pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
+ return 0;
+
for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
pfn = page_to_pfn(skb_shinfo(skb)->frags[i].page);
if (!is_foreign(pfn))
|
GitWeb
