The fix basically tightens up consistency checks in the process of
reading the skb (which is done in the sk->data_ready() callback).
Cheers,
Trond
diff -u --recursive --new-file linux-2.5.66-10-nr_dirty/net/sunrpc/xprt.c linux-2.5.66-11-fix_read/net/sunrpc/xprt.c
--- linux-2.5.66-10-nr_dirty/net/sunrpc/xprt.c 2003-03-27 18:34:08.000000000 +0100
+++ linux-2.5.66-11-fix_read/net/sunrpc/xprt.c 2003-04-07 15:15:29.000000000 +0200
@@ -625,7 +625,8 @@
{
if (len > desc->count)
len = desc->count;
- skb_copy_bits(desc->skb, desc->offset, to, len);
+ if (skb_copy_bits(desc->skb, desc->offset, to, len))
+ return 0;
desc->count -= len;
desc->offset += len;
return len;
@@ -669,11 +670,15 @@
csum2 = skb_checksum(skb, desc.offset, skb->len - desc.offset, 0);
desc.csum = csum_block_add(desc.csum, csum2, desc.offset);
}
+ if (desc.count)
+ return -1;
if ((unsigned short)csum_fold(desc.csum))
return -1;
return 0;
no_checksum:
xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_bits);
+ if (desc.count)
+ return -1;
return 0;
}
@@ -750,7 +755,8 @@
{
if (len > desc->count)
len = desc->count;
- skb_copy_bits(desc->skb, desc->offset, p, len);
+ if (skb_copy_bits(desc->skb, desc->offset, p, len))
+ return 0;
desc->offset += len;
desc->count -= len;
return len;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/