Re: [PATCH 2/2 v2] bonding: COW before overwriting the destination MAC address
From: Eric Dumazet <hidden>
Date: 2011-03-03 07:55:06
Le jeudi 03 mars 2011 à 15:07 +0800, Changli Gao a écrit :
quoted hunk ↗ jump to hunk
When there is a ptype handler holding a clone of this skb, whose destination MAC addresse is overwritten, the owner of this handler may get a corrupted packet. Signed-off-by: Changli Gao <redacted> --- v2: fix the bug in the previous one. Thank him. drivers/net/bonding/bond_main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 912b416..7b7ca97 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c@@ -1511,9 +1511,13 @@ static struct sk_buff *bond_handle_frame(struct sk_buff *skb) if (bond_dev->priv_flags & IFF_MASTER_ALB && bond_dev->priv_flags & IFF_BRIDGE_PORT && skb->pkt_type == PACKET_HOST) { - u16 *dest = (u16 *) eth_hdr(skb)->h_dest; - memcpy(dest, bond_dev->dev_addr, ETH_ALEN); + if (unlikely(skb_cow_head(skb, + skb->data - skb_mac_header(skb)))) { + kfree_skb(skb); + return NULL; + } + memcpy(eth_hdr(skb)->h_dest, bond_dev->dev_addr, ETH_ALEN); } return skb;
Thats minor, but using : u16 *dest = eth_hdr(skb)->h_dest; memcpy(dest, ptr, ETH_ALEN); Is better because compiler knows both destination and source are at least aligned on shorts. On some arches, it helps to not using 6 bytes copy, but 3 shorts.