diff options
| author | Changli Gao <xiaosuo@gmail.com> | 2011-03-03 00:07:14 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-03-08 02:45:08 +0300 |
| commit | 541ac7c9b30ee2ff84ad87f27e0bc069e143afb5 (patch) | |
| tree | bb1e2377bf33ecee73518b0c517980f5a33b8405 | |
| parent | cca134fe784a01cf4eb9f0621b0104591b7ddfba (diff) | |
| download | linux-541ac7c9b30ee2ff84ad87f27e0bc069e143afb5.tar.xz | |
bonding: COW before overwriting the destination MAC address
When there is a ptype handler holding a clone of this skb, whose
destination MAC addresse is overwritten, the owner of this handler may
get a corrupted packet.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/bonding/bond_main.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 912b416b7573..7b7ca971672f 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1511,9 +1511,13 @@ static struct sk_buff *bond_handle_frame(struct sk_buff *skb) if (bond_dev->priv_flags & IFF_MASTER_ALB && bond_dev->priv_flags & IFF_BRIDGE_PORT && skb->pkt_type == PACKET_HOST) { - u16 *dest = (u16 *) eth_hdr(skb)->h_dest; - memcpy(dest, bond_dev->dev_addr, ETH_ALEN); + if (unlikely(skb_cow_head(skb, + skb->data - skb_mac_header(skb)))) { + kfree_skb(skb); + return NULL; + } + memcpy(eth_hdr(skb)->h_dest, bond_dev->dev_addr, ETH_ALEN); } return skb; |