RE: [PATCH] net: Fix skb_under_panic oops in neigh_resolve_output

On Fri, 2012-10-05 at 12:33 -0400, Ramesh Nagappa wrote:

Hi Eric,

Yes, that is a good optimization. neigh_resolve_output() also has the
__skb_pull() outside the loop, is that required ? The changes would be
like ...

neigh_resolve_output()
...
-        __skb_pull(skb, skb_network_offset(skb));


        if (!neigh_event_send(neigh, skb)) {
                int err;
                struct net_device *dev = neigh->dev;
                unsigned int seq;

                if (dev->header_ops->cache && !neigh->hh.hh_len)
                        neigh_hh_init(neigh, dst);

                do {                        
+			      __skb_pull(skb, skb_network_offset(skb));
                        seq = read_seqbegin(&neigh->ha_lock);
                        err = dev_hard_header(skb, dev, ntohs(skb->protocol),
                                              neigh->ha, NULL, skb->len);
                } while (read_seqretry(&neigh->ha_lock, seq));

All similar constructions should be audited.

For example in net/decnet/dn_neigh.c , dn_neigh_output_packet()