ip_gre: dont increase dev->needed_headroom on a live device
authorEric Dumazet <eric.dumazet@gmail.com>
Fri, 14 Oct 2011 04:57:46 +0000 (04:57 +0000)
committerDavid S. Miller <davem@davemloft.net>
Thu, 20 Oct 2011 20:20:30 +0000 (16:20 -0400)
commit113ab386c7d6625cff284fb10952ff69a58c18a4
tree1334a0c133d6348f72619fdc502088644fba1c3b
parentfd11e153b82ad1c84ccc71ba1cfedc222465198c
ip_gre: dont increase dev->needed_headroom on a live device

It seems ip_gre is able to change dev->needed_headroom on the fly.

Its is not legal unfortunately and triggers a BUG in raw_sendmsg()

skb = sock_alloc_send_skb(sk, ... + LL_ALLOCATED_SPACE(rt->dst.dev)

< another cpu change dev->needed_headromm (making it bigger)

...
skb_reserve(skb, LL_RESERVED_SPACE(rt->dst.dev));

We end with LL_RESERVED_SPACE() being bigger than LL_ALLOCATED_SPACE()
-> we crash later because skb head is exhausted.

Bug introduced in commit 243aad83 in 2.6.34 (ip_gre: include route
header_len in max_headroom calculation)

Reported-by: Elmar Vonlanthen <evonlanthen@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Timo Teräs <timo.teras@iki.fi>
CC: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ip_gre.c