diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2010-09-17 22:58:08 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-09-17 22:58:08 -0700 |
| commit | 04746ff1289f75af26af279eb4b0b3e231677ee4 (patch) | |
| tree | 826160df5f9786dd15803b1ebfc14b8e3fa87608 /net | |
| parent | 4e8cec269dd9e823804141f25ce37c23e72d3c12 (diff) | |
| download | op-kernel-dev-04746ff1289f75af26af279eb4b0b3e231677ee4.zip op-kernel-dev-04746ff1289f75af26af279eb4b0b3e231677ee4.tar.gz | |
qlcnic: dont assume NET_IP_ALIGN is 2
qlcnic driver allocates rx skbs and gives to hardware too bytes of extra
storage, allowing for corruption of kernel data.
NET_IP_ALIGN being 0 on some platforms (including x86), drivers should
not assume it's 2.
rds_ring->skb_size = rds_ring->dma_size + NET_IP_ALIGN;
...
skb = dev_alloc_skb(rds_ring->skb_size);
skb_reserve(skb, 2);
pci_map_single(pdev, skb->data, rds_ring->dma_size, PCI_DMA_FROMDEVICE);
(and rds_ring->skb_size == rds_ring->dma_size) -> bug
Because of extra alignment (1500 + 32) -> four extra bytes are available
before the struct skb_shared_info, so corruption is not noticed.
Note: this driver could use netdev_alloc_skb_ip_align()
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions
