xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

af_iucv: fix recvmsg by replacing skb_pull() function

Browse Source 
When receiving data messages, the "BUG_ON(skb->len < skb->data_len)" in
the skb_pull() function triggers a kernel panic.

Replace the skb_pull logic by a per skb offset as advised by
Eric Dumazet.

Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: Frank Blaschka <blaschka@linux.vnet.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ursula Braun
2013-04-07 22:19:26 +00:00
committed by David S. Miller
parent 88c5b5ce5c
commit f9c41a62bb
2 changed files with 24 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/net/iucv/af_iucv.h
View File

@@ -130,6 +130,14 @@ struct iucv_sock {
enum iucv_tx_notify n);
};
struct iucv_skb_cb {
u32 class; /* target class of message */
u32 tag; /* tag associated with message */
u32 offset; /* offset for skb receival */
};
#define IUCV_SKB_CB(__skb) ((struct iucv_skb_cb *)&((__skb)->cb[0]))
/* iucv socket options (SOL_IUCV) */
#define SO_IPRMDATA_MSG 0x0080 /* send/recv IPRM_DATA msgs */
#define SO_MSGLIMIT 0x1000 /* get/set IUCV MSGLIMIT */