releases/3.6.4/net-fix-skb_under_panic-oops-in-neigh_resolve_output.patch

   1 From d61270aec5acf274b0c23f2524698d6745c49e51 Mon Sep 17 00:00:00 2001
   2 From: "ramesh.nagappa@gmail.com" <ramesh.nagappa@gmail.com>
   3 Date: Fri, 5 Oct 2012 19:10:15 +0000
   4 Subject: net: Fix skb_under_panic oops in neigh_resolve_output
   5
   6
   7 From: "ramesh.nagappa@gmail.com" <ramesh.nagappa@gmail.com>
   8
   9 [ Upstream commit e1f165032c8bade3a6bdf546f8faf61fda4dd01c ]
  10
  11 The retry loop in neigh_resolve_output() and neigh_connected_output()
  12 call dev_hard_header() with out reseting the skb to network_header.
  13 This causes the retry to fail with skb_under_panic. The fix is to
  14 reset the network_header within the retry loop.
  15
  16 Signed-off-by: Ramesh Nagappa <ramesh.nagappa@ericsson.com>
  17 Reviewed-by: Shawn Lu <shawn.lu@ericsson.com>
  18 Reviewed-by: Robert Coulson <robert.coulson@ericsson.com>
  19 Reviewed-by: Billie Alsup <billie.alsup@ericsson.com>
  20 Signed-off-by: David S. Miller <davem@davemloft.net>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22 ---
  23  net/core/neighbour.c |    6 ++----
  24  1 file changed, 2 insertions(+), 4 deletions(-)
  25
  26 --- a/net/core/neighbour.c
  27 +++ b/net/core/neighbour.c
  28 @@ -1301,8 +1301,6 @@ int neigh_resolve_output(struct neighbou
  29         if (!dst)
  30                 goto discard;
  31
  32 -       __skb_pull(skb, skb_network_offset(skb));
  33 -
  34         if (!neigh_event_send(neigh, skb)) {
  35                 int err;
  36                 struct net_device *dev = neigh->dev;
  37 @@ -1312,6 +1310,7 @@ int neigh_resolve_output(struct neighbou
  38                         neigh_hh_init(neigh, dst);
  39
  40                 do {
  41 +                       __skb_pull(skb, skb_network_offset(skb));
  42                         seq = read_seqbegin(&neigh->ha_lock);
  43                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
  44                                               neigh->ha, NULL, skb->len);
  45 @@ -1342,9 +1341,8 @@ int neigh_connected_output(struct neighb
  46         unsigned int seq;
  47         int err;
  48
  49 -       __skb_pull(skb, skb_network_offset(skb));
  50 -
  51         do {
  52 +               __skb_pull(skb, skb_network_offset(skb));
  53                 seq = read_seqbegin(&neigh->ha_lock);
  54                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
  55                                       neigh->ha, NULL, skb->len);