aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/generic/pending-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch
diff options
context:
space:
mode:
authorHauke Mehrtens <hauke@hauke-m.de>2019-03-25 15:29:06 +0100
committerHauke Mehrtens <hauke@hauke-m.de>2019-05-03 22:41:38 +0200
commit1325e74e0c2f9ebdafe05b1492cec77a60059920 (patch)
treeaf21c4890a4ae5c08dc08ee7cabdc14a651f33ad /target/linux/generic/pending-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch
parent675832de79ec14ddc1183a66d1084aff7a856289 (diff)
downloadupstream-1325e74e0c2f9ebdafe05b1492cec77a60059920.tar.gz
upstream-1325e74e0c2f9ebdafe05b1492cec77a60059920.tar.bz2
upstream-1325e74e0c2f9ebdafe05b1492cec77a60059920.zip
kernel: Remove support for kernel 3.18
No target is using kernel 3.18 anymore, remove all the generic support for kernel 3.18. The removed packages are depending on kernel 3.18 only and are not used on any recent kernel. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Diffstat (limited to 'target/linux/generic/pending-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch')
-rw-r--r--target/linux/generic/pending-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch101
1 files changed, 0 insertions, 101 deletions
diff --git a/target/linux/generic/pending-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch b/target/linux/generic/pending-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch
deleted file mode 100644
index 8990061303..0000000000
--- a/target/linux/generic/pending-3.18/082-ipv6-ip6_fragment-fix-headroom-tests-and-skb-leak.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From: Florian Westphal <fw@strlen.de>
-Date: Thu, 17 Sep 2015 11:24:48 +0100
-Subject: [PATCH] ipv6: ip6_fragment: fix headroom tests and skb leak
-
-David Woodhouse reports skb_under_panic when we try to push ethernet
-header to fragmented ipv6 skbs:
-
- skbuff: skb_under_panic: text:c1277f1e len:1294 put:14 head:dec98000
- data:dec97ffc tail:0xdec9850a end:0xdec98f40 dev:br-lan
-[..]
-ip6_finish_output2+0x196/0x4da
-
-David further debugged this:
- [..] offending fragments were arriving here with skb_headroom(skb)==10.
- Which is reasonable, being the Solos ADSL card's header of 8 bytes
- followed by 2 bytes of PPP frame type.
-
-The problem is that if netfilter ipv6 defragmentation is used, skb_cow()
-in ip6_forward will only see reassembled skb.
-
-Therefore, headroom is overestimated by 8 bytes (we pulled fragment
-header) and we don't check the skbs in the frag_list either.
-
-We can't do these checks in netfilter defrag since outdev isn't known yet.
-
-Furthermore, existing tests in ip6_fragment did not consider the fragment
-or ipv6 header size when checking headroom of the fraglist skbs.
-
-While at it, also fix a skb leak on memory allocation -- ip6_fragment
-must consume the skb.
-
-I tested this e1000 driver hacked to not allocate additional headroom
-(we end up in slowpath, since LL_RESERVED_SPACE is 16).
-
-If 2 bytes of headroom are allocated, fastpath is taken (14 byte
-ethernet header was pulled, so 16 byte headroom available in all
-fragments).
-
-Reported-by: David Woodhouse <dwmw2@infradead.org>
-Diagnosed-by: David Woodhouse <dwmw2@infradead.org>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Closes 20532
----
-
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -603,20 +603,22 @@ int ip6_fragment(struct sk_buff *skb, in
- }
- mtu -= hlen + sizeof(struct frag_hdr);
-
-+ hroom = LL_RESERVED_SPACE(rt->dst.dev);
- if (skb_has_frag_list(skb)) {
- int first_len = skb_pagelen(skb);
- struct sk_buff *frag2;
-
- if (first_len - hlen > mtu ||
- ((first_len - hlen) & 7) ||
-- skb_cloned(skb))
-+ skb_cloned(skb) ||
-+ skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
- goto slow_path;
-
- skb_walk_frags(skb, frag) {
- /* Correct geometry. */
- if (frag->len > mtu ||
- ((frag->len & 7) && frag->next) ||
-- skb_headroom(frag) < hlen)
-+ skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))
- goto slow_path_clean;
-
- /* Partially cloned skb? */
-@@ -633,8 +635,6 @@ int ip6_fragment(struct sk_buff *skb, in
-
- err = 0;
- offset = 0;
-- frag = skb_shinfo(skb)->frag_list;
-- skb_frag_list_init(skb);
- /* BUILD HEADER */
-
- *prevhdr = NEXTHDR_FRAGMENT;
-@@ -642,8 +642,11 @@ int ip6_fragment(struct sk_buff *skb, in
- if (!tmp_hdr) {
- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
- IPSTATS_MIB_FRAGFAILS);
-- return -ENOMEM;
-+ err = -ENOMEM;
-+ goto fail;
- }
-+ frag = skb_shinfo(skb)->frag_list;
-+ skb_frag_list_init(skb);
-
- __skb_pull(skb, hlen);
- fh = (struct frag_hdr *)__skb_push(skb, sizeof(struct frag_hdr));
-@@ -741,7 +744,6 @@ slow_path:
- */
-
- *prevhdr = NEXTHDR_FRAGMENT;
-- hroom = LL_RESERVED_SPACE(rt->dst.dev);
- troom = rt->dst.dev->needed_tailroom;
-
- /*