From 541ac7c9b30ee2ff84ad87f27e0bc069e143afb5 Mon Sep 17 00:00:00 2001 From: Changli Gao Date: Wed, 2 Mar 2011 21:07:14 +0000 Subject: [PATCH] bonding: COW before overwriting the destination MAC address When there is a ptype handler holding a clone of this skb, whose destination MAC addresse is overwritten, the owner of this handler may get a corrupted packet. Signed-off-by: Changli Gao Signed-off-by: David S. Miller --- drivers/net/bonding/bond_main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 912b416b757..7b7ca971672 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1511,9 +1511,13 @@ static struct sk_buff *bond_handle_frame(struct sk_buff *skb) if (bond_dev->priv_flags & IFF_MASTER_ALB && bond_dev->priv_flags & IFF_BRIDGE_PORT && skb->pkt_type == PACKET_HOST) { - u16 *dest = (u16 *) eth_hdr(skb)->h_dest; - memcpy(dest, bond_dev->dev_addr, ETH_ALEN); + if (unlikely(skb_cow_head(skb, + skb->data - skb_mac_header(skb)))) { + kfree_skb(skb); + return NULL; + } + memcpy(eth_hdr(skb)->h_dest, bond_dev->dev_addr, ETH_ALEN); } return skb; -- 2.39.5