diff options
| author | David S. Miller <davem@nuts.davemloft.net> | 2004-09-28 00:47:53 -0700 |
|---|---|---|
| committer | David S. Miller <davem@nuts.davemloft.net> | 2004-09-28 00:47:53 -0700 |
| commit | caff42cdf2430c53aeab5c13019d8997703a8741 (patch) | |
| tree | 836b7023fd14c061ec891dd2ee7c2d74ad99d4f8 | |
| parent | 2eff7ad471c23d0aa074fc738c41658269abce30 (diff) | |
[NETLINK]: In netlink_trim(), verify that SKB is not on a list.
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/netlink/af_netlink.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 8bcf3f30f306..1a7b78619b85 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -540,6 +540,12 @@ static inline void netlink_trim(struct sk_buff *skb, int allocation) { int delta = skb->end - skb->tail; + /* If the packet is charged to a socket, the modification + * of truesize below is illegal and will corrupt socket + * buffer accounting state. + */ + BUG_ON(skb->list != NULL); + if (delta * 2 < skb->truesize) return; if (pskb_expand_head(skb, 0, -delta, allocation)) |