Re: [2.6.0-test8/9] ethertap oops

Simon Roscic [off-list ref] writes:

EIP is at ethertap_rx+0x131/0x2a0 [ethertap]

Does this patch fix it?

-Andi

diff -u linux-2.6.0test7mm1-averell/drivers/net/ethertap.c-o linux-2.6.0test7mm1-averell/drivers/net/ethertap.c

--- linux-2.6.0test7mm1-averell/drivers/net/ethertap.c-o	2003-09-11 04:12:33.000000000 +0200
+++ linux-2.6.0test7mm1-averell/drivers/net/ethertap.c	2003-10-26 23:41:17.000000000 +0100

@@ -302,11 +302,12 @@
 
 static void ethertap_rx(struct sock *sk, int len)
 {
-	struct net_device *dev = tap_map[sk->sk_protocol];
+	unsigned unit = sk->sk_protocol - NETLINK_TAPBASE; 
+	struct net_device *dev;
 	struct sk_buff *skb;
 
-	if (dev==NULL) {
-		printk(KERN_CRIT "ethertap: bad unit!\n");
+	if (unit >= max_taps || (dev = tap_map[unit]) == NULL) { 
+		printk(KERN_CRIT "ethertap: bad unit %u!\n", unit);
 		skb_queue_purge(&sk->sk_receive_queue);
 		return;
 	}

diff -u linux-2.6.0test7mm1-averell/net/netlink/af_netlink.c-o linux-2.6.0test7mm1-averell/net/netlink/af_netlink.c

--- linux-2.6.0test7mm1-averell/net/netlink/af_netlink.c-o	2003-10-09 00:29:02.000000000 +0200
+++ linux-2.6.0test7mm1-averell/net/netlink/af_netlink.c	2003-10-26 23:42:44.000000000 +0100

@@ -777,6 +777,7 @@
 	if (input)
 		nlk_sk(sk)->data_ready = input;
 
+	sk->sk_protocol = unit;
 	netlink_insert(sk, 0);
 	return sk;
 }

On Sun, 26 Oct 2003 23:45:52 +0100
Andi Kleen [off-list ref] wrote:

This part looks good, applied.

This part is not needed, netlink_create() does this for us :-)

Thanks Andi.

On Sun, Oct 26, 2003 at 11:48:28PM -0800, David S. Miller wrote:

On Sun, 26 Oct 2003 23:45:52 +0100
Andi Kleen [off-list ref] wrote:

quoted

diff -u linux-2.6.0test7mm1-averell/drivers/net/ethertap.c-o linux-2.6.0test7mm1-averell/drivers/net/ethertap.c

--- linux-2.6.0test7mm1-averell/drivers/net/ethertap.c-o	2003-09-11 04:12:33.000000000 +0200
+++ linux-2.6.0test7mm1-averell/drivers/net/ethertap.c	2003-10-26 23:41:17.000000000 +0100

This part looks good, applied.

I don't know if it actually fixed the bug, I did not test it
(sorry, should have stated that in the original mail)
But at least it should printk now instead of crashing.

-Andi