From 863fae666acb87b150f4634e6e79476ebe274f43 Mon Sep 17 00:00:00 2001 From: Allan Stephens Date: Mon, 3 Jul 2006 19:39:36 -0700 Subject: [TIPC] Fixed sk_buff panic caused by tipc_link_bundle_buf (REVISED) The recent change to direct inspection of bundle buffer tailroom did not account for the possiblity of unrequested tailroom added by skb_alloc(), thereby allowing a bundle to be created that exceeds the current link MTU. An additional check now ensures that bundling works correctly no matter if the bundle buffer is smaller, larger, or equal to the link MTU. Signed-off-by: Allan Stephens Signed-off-by: Per Liden Signed-off-by: David S. Miller --- net/tipc/link.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'net/tipc/link.c') diff --git a/net/tipc/link.c b/net/tipc/link.c index c6831c75cfa..c10e18a49b9 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -998,6 +998,8 @@ static int link_bundle_buf(struct link *l_ptr, return 0; if (skb_tailroom(bundler) < (pad + size)) return 0; + if (link_max_pkt(l_ptr) < (to_pos + size)) + return 0; skb_put(bundler, pad + size); memcpy(bundler->data + to_pos, buf->data, size); -- cgit v1.2.3