Commit 918b7024 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'skb_cow_head' 



Eric Dumazet says:

====================
net: use skb_cow_head() to deal with cloned skbs

James Hughes found an issue with smsc95xx driver. Same problematic code
is found in other drivers.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 95b9b88d 39fba783

drivers/net/usb/ch9200.c

+2 −7
Original line number Diff line number Diff line
@@ -254,13 +254,8 @@ static struct sk_buff *ch9200_tx_fixup(struct usbnet *dev, struct sk_buff *skb, 
	tx_overhead = 0x40;



	len = skb->len;

	if (skb_headroom(skb) < tx_overhead) {

		struct sk_buff *skb2;



		skb2 = skb_copy_expand(skb, tx_overhead, 0, flags);

	if (skb_cow_head(skb, tx_overhead)) {

		dev_kfree_skb_any(skb);

		skb = skb2;

		if (!skb)

		return NULL;

	}

drivers/net/usb/cx82310_eth.c

+2 −5
Original line number Diff line number Diff line
@@ -293,11 +293,8 @@ static struct sk_buff *cx82310_tx_fixup(struct usbnet *dev, struct sk_buff *skb, 
{

	int len = skb->len;



	if (skb_headroom(skb) < 2) {

		struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);

	if (skb_cow_head(skb, 2)) {

		dev_kfree_skb_any(skb);

		skb = skb2;

		if (!skb)

		return NULL;

	}

	skb_push(skb, 2);

drivers/net/usb/kaweth.c

+6 −12
Original line number Diff line number Diff line
@@ -803,19 +803,13 @@ static netdev_tx_t kaweth_start_xmit(struct sk_buff *skb, 
	}



	/* We now decide whether we can put our special header into the sk_buff */

	if (skb_cloned(skb) || skb_headroom(skb) < 2) {

		/* no such luck - we make our own */

		struct sk_buff *copied_skb;

		copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC);

		dev_kfree_skb_irq(skb);

		skb = copied_skb;

		if (!copied_skb) {

	if (skb_cow_head(skb, 2)) {

		kaweth->stats.tx_errors++;

		netif_start_queue(net);

		spin_unlock_irq(&kaweth->device_lock);

		dev_kfree_skb_any(skb);

		return NETDEV_TX_OK;

	}

	}



	private_header = (__le16 *)__skb_push(skb, 2);

	*private_header = cpu_to_le16(skb->len-2);

drivers/net/usb/lan78xx.c

+2 −7
Original line number Diff line number Diff line
@@ -2607,13 +2607,8 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, 
{

	u32 tx_cmd_a, tx_cmd_b;



	if (skb_headroom(skb) < TX_OVERHEAD) {

		struct sk_buff *skb2;



		skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);

	if (skb_cow_head(skb, TX_OVERHEAD)) {

		dev_kfree_skb_any(skb);

		skb = skb2;

		if (!skb)

		return NULL;

	}

drivers/net/usb/smsc75xx.c

+2 −6
Original line number Diff line number Diff line
@@ -2203,12 +2203,8 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev, 
{

	u32 tx_cmd_a, tx_cmd_b;



	if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {

		struct sk_buff *skb2 =

			skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);

	if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {

		dev_kfree_skb_any(skb);

		skb = skb2;

		if (!skb)

		return NULL;

	}