| From stable-bounces@linux.kernel.org Mon Dec 4 20:02:22 2006 |
| Date: Mon, 04 Dec 2006 19:57:11 -0800 (PST) |
| Message-Id: <20061204.195711.45741021.davem@davemloft.net> |
| To: stable@kernel.org |
| From: David Miller <davem@davemloft.net> |
| Subject: TOKENRING: Remote memory corruptor in ibmtr.c |
| |
| ip_summed changes last summer had missed that one. As the result, |
| we have ip_summed interpreted as CHECKSUM_PARTIAL now. IOW, |
| ->csum is interpreted as offset of checksum in the packet. net/core/* |
| will both read and modify the value as that offset, with obvious |
| reasons. At the very least it's a remote memory corruptor. |
| |
| Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Chris Wright <chrisw@sous-sol.org> |
| --- |
| commit b1875feda8c1735915e12d953acba85d96129f6a |
| Author: Al Viro <viro@zeniv.linux.org.uk> |
| Date: Mon Dec 4 19:37:42 2006 -0800 |
| |
| drivers/net/tokenring/ibmtr.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- linux-2.6.19.orig/drivers/net/tokenring/ibmtr.c |
| +++ linux-2.6.19/drivers/net/tokenring/ibmtr.c |
| @@ -1826,7 +1826,7 @@ static void tr_rx(struct net_device *dev |
| skb->protocol = tr_type_trans(skb, dev); |
| if (IPv4_p) { |
| skb->csum = chksum; |
| - skb->ip_summed = 1; |
| + skb->ip_summed = CHECKSUM_COMPLETE; |
| } |
| netif_rx(skb); |
| dev->last_rx = jiffies; |
