Skip to contentSkip to conversation

AX.25: Fix packet socket crash

PATCH Applied Ralf Baechle DL5RB 2 participants 2 messages Oct 4, 2005 – Oct 5, 2005

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Ralf Baechle DL5RB

author
#0 lore raw

PATCH 1/1 AX.25: Fix packet socket crash

Since changeset 98a82febb6340466824c3a453738d4fbd05db81a AX.25 is passing received IP and ARP packets to the stack through netif_rx() but we don't set the skb->mac.raw to right value which may result in a crash with applications that use a packet socket.

Signed-off-by Ralf Baechle DL5RB <[email protected]>
 net/ax25/ax25_in.c  |    2 +-
 net/netrom/nr_dev.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
net/ax25/ax25_in.c +1 -1
Index: linux-cvs/net/ax25/ax25_in.c
===================================================================
@@ -123,7 +123,7 @@ int ax25_rx_iframe(ax25_cb *ax25, struct
 		}
 
 		skb_pull(skb, 1);	/* Remove PID */
-		skb->h.raw    = skb->data;
+		skb->mac.raw  = skb->nh.raw;
 		skb->nh.raw   = skb->data;
 		skb->dev      = ax25->ax25_dev->dev;
 		skb->pkt_type = PACKET_HOST;
net/netrom/nr_dev.c +1 -1
Index: linux-cvs/net/netrom/nr_dev.c
===================================================================
@@ -58,7 +58,7 @@ int nr_rx_ip(struct sk_buff *skb, struct
 
 	/* Spoof incoming device */
 	skb->dev      = dev;
-	skb->h.raw    = skb->data;
+	skb->mac.raw  = skb->nh.raw;
 	skb->nh.raw   = skb->data;
 	skb->pkt_type = PACKET_HOST;
maintainer Applied
#1 lore raw

From: Ralf Baechle DL5RB <[email protected]>
Date: Tue, 4 Oct 2005 20:48:03 +0100

Quoted 6 lines

Since changeset 98a82febb6340466824c3a453738d4fbd05db81a AX.25 is passing received IP and ARP packets to the stack through netif_rx() but we don't set the skb->mac.raw to right value which may result in a crash with applications that use a packet socket.

Signed-off-by Ralf Baechle DL5RB <[email protected]>

Applied, thanks a lot Ralf.