From: Jim Westfall <[EMAIL PROTECTED]>
Date: Wed, 20 Feb 2008 21:46:48 -0800
> static inline void llc_pdu_init_as_test_rsp(struct sk_buff *skb,
> struct sk_buff *ev_skb)
> {
> struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
>
> pdu->ctrl_1 = LLC_PDU_TYPE_U;
> pdu->ctrl_1 |= LLC_1_PDU_CMD_TEST;
> pdu->ctrl_1 |= LLC_U_PF_BIT_MASK;
> if (ev_skb->protocol == htons(ETH_P_802_2)) {
> struct llc_pdu_un *ev_pdu = llc_pdu_un_hdr(ev_skb);
> int dsize;
>
> dsize = ntohs(eth_hdr(ev_skb)->h_proto) - 3;
> memcpy(((u8 *)pdu) + 3, ((u8 *)ev_pdu) + 3, dsize);
> skb_put(skb, dsize);
> }
> ..
> }
Probably what should happen is:
1) First this function validates that there are really
'dsize' bytes available in the ev_skb source.
2) Second, skb_realloc_headroom() is called on 'skb' with
a second argument of 'dsize'.
That means also this function now needs to return error
values, and the callers updated to handle that.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
