skpush bug?

Blu3Viper (david@127-0-0-1.kalifornia.com)
Tue, 13 Jan 1998 10:21:54 -0800 (PST)


Alan, is this really a bug or is Dennis (from etinc) being sassy as usual?

[snipped/reformatted]
On Tue, 13 Jan 1998, dennis wrote:
> Are you runnig proxy-arp or defrag code? there is a linux bug with icmp
> packets over 1500 bytes. A. Cox said he was "looking into it"....its a
> pretty bad implementation that causes the skbuf code to panic if there
> is no room for the packet header, and a bug that causes there to be no
> room. You can hack skpush to avoid the panic.
>
> Here's the patch, the old version and the new version. This will result
> in a malformed packet being sent, but avoid the panic
>
> /* original copy
> unsigned char *skb_push(struct sk_buff *skb, int len)
> {
> IS_SKB(skb);
> skb->data-=len;
> skb->len+=len;
> IS_SKB(skb);
> if(skb->data<skb->head)
> panic("skpush:under: %p:%d", __builtin_return_address(0),len);
> return skb->data;
> }
> */
> /* new and safer version. Simply refuses to add data if no room */
>
> unsigned char *skb_push(struct sk_buff *skb, int len)
> {
> IS_SKB(skb);
> if ((skb->data-len)<skb->head){
> printk("WARNING: skb_push: No header space\n");
> return(skb->data);
> }
> skb->data-=len;
> skb->len+=len;
> IS_SKB(skb);
> /*
> if(skb->data<skb->head)
> panic("skpush:under: %p:%d", __builtin_return_address(0),len);
> */
> return skb->data;
> }
>
> Dennis

[reply to: david@127-0-0-1.kalifornia.com without the 127-0-0-1.]
*** *** Flames will go to /dev/null
** WARNING ** SPAM mail will be returned to you at a
*** *** minimum rate of 50,000 copies per email