Eric Dumazet 4ea2739ea8 pptp: pptp_rcv_core() misses pskb_may_pull() call ... e1000e uses paged frags, so any layer incorrectly pulling bytes from skb can trigger a BUG in skb_pull() [951.142737] [<ffffffff813d2f36>] skb_pull+0x15/0x17 [951.142737] [<ffffffffa0286824>] pptp_rcv_core+0x126/0x19a [pptp] [951.152725] [<ffffffff813d17c4>] sk_receive_skb+0x69/0x105 [951.163558] [<ffffffffa0286993>] pptp_rcv+0xc8/0xdc [pptp] [951.165092] [<ffffffffa02800a3>] gre_rcv+0x62/0x75 [gre] [951.165092] [<ffffffff81410784>] ip_local_deliver_finish+0x150/0x1c1 [951.177599] [<ffffffff81410634>] ? ip_local_deliver_finish+0x0/0x1c1 [951.177599] [<ffffffff81410846>] NF_HOOK.clone.7+0x51/0x58 [951.177599] [<ffffffff81410996>] ip_local_deliver+0x51/0x55 [951.177599] [<ffffffff814105b9>] ip_rcv_finish+0x31a/0x33e [951.177599] [<ffffffff8141029f>] ? ip_rcv_finish+0x0/0x33e [951.204898] [<ffffffff81410846>] NF_HOOK.clone.7+0x51/0x58 [951.214651] [<ffffffff81410bb5>] ip_rcv+0x21b/0x246 pptp_rcv_core() is a nice example of a function assuming everything it needs is available in skb head. Reported-by: Bradley Peterson <despite@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2011-10-19 03:50:43 -04:00
..
accessibility
acpi	Merge branches 'apei', 'bz-13195' and 'doc' into acpi	2011-09-12 20:00:00 -04:00
amba
ata	drivers/ata/sata_dwc_460ex.c: add missing kfree	2011-08-18 23:58:11 -04:00
atm
auxdisplay
base	PM / Clocks: Do not acquire a mutex under a spinlock	2011-09-26 19:40:23 +02:00
bcma	bcma: add uevent to the bus, to autoload drivers	2011-08-22 14:21:41 -04:00
block	floppy: use del_timer_sync() in init cleanup	2011-09-21 10:22:11 +02:00
bluetooth	Bluetooth: add support for 2011 mac mini	2011-09-17 17:16:03 -03:00
cdrom	drivers/cdrom/cdrom.c: relax check on dvd manufacturer value	2011-08-02 12:43:50 +02:00
char	TPM: Zero buffer after copying to userspace	2011-09-23 09:46:41 +10:00
clk
clocksource	Merge branch 'common/core' into sh-latest	2011-08-08 16:33:54 +09:00
connector	proc_fork_connector: a lockless ->real_parent usage is not safe	2011-07-28 18:26:32 -07:00
cpufreq	drivers/cpufreq/pcc-cpufreq.c: avoid NULL pointer dereference	2011-09-14 18:09:38 -07:00
cpuidle	cpuidle: stop depending on pm_idle	2011-08-03 19:06:37 -04:00
crypto	n2_crypto: Attach on Niagara-T3.	2011-07-28 01:30:07 -07:00
dca
dio
dma	dmaengine/ste_dma40: fix memory leak due to prepared descriptors	2011-09-05 17:08:26 +05:30
edac	i7core_edac: fixed typo in error count calculation	2011-08-18 14:07:15 -07:00
eisa	eisa/pci_eisa.c: fix BUG introduced by 005bdad7b8	2011-08-04 06:32:51 -10:00
firewire	firewire: ohci: add no MSI quirk for O2Micro controller	2011-09-16 22:22:10 +02:00
firmware	firmware: fix google/gsmi.c build warning	2011-08-08 13:53:49 -07:00
gpio	gpio-pca953x: fix gpio_base	2011-10-13 13:49:37 -06:00
gpu	drm/radeon/kms: use hardcoded dig encoder to transmitter mapping for DCE4.1	2011-10-06 11:45:30 +01:00
hid	Merge branch 'for-linus' of git://github.com/dtor/input	2011-09-16 14:09:19 -07:00
hwmon	hwmon: (w83627ehf) Properly report thermal diode sensors	2011-10-13 16:51:29 -07:00
hwspinlock
i2c	i2c-tegra: fix possible race condition after tx	2011-09-07 00:13:40 +01:00
ide	ide: Fix file references in drivers/ide/	2011-10-13 18:25:11 +12:00
idle
ieee802154
infiniband	[SCSI] cxgb3i: convert cdev->l2opt to use rcu to prevent NULL dereference	2011-09-26 09:28:01 -05:00
input	Merge branch 'for-linus' of git://github.com/dtor/input	2011-10-05 09:22:38 -07:00
iommu	x86, iommu: Mark DMAR IRQ as non-threaded	2011-09-13 23:44:53 +02:00
isdn	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2011-07-28 05:58:19 -07:00
leds	drivers/leds/ledtrig-timer.c: fix broken sysfs delay handling	2011-09-14 18:09:38 -07:00
lguest
macintosh
mca
md	Merge branch 'for-linus' of http://people.redhat.com/agk/git/linux-dm	2011-10-06 08:31:47 -07:00
media	[media] omap3isp: Fix build error in ispccdc.c	2011-09-21 22:18:26 -03:00
memstick
message	Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6	2011-07-30 08:36:02 -10:00
mfd	mfd: Fix generic irq chip ack function name for jz4740-adc	2011-09-21 13:06:34 +02:00
misc	lis3: fix regression of HP DriveGuard with 8bit chip	2011-10-03 20:51:51 -07:00
mmc	Merge branch 'for-linus' of git://git.kernel.dk/linux-block	2011-09-21 13:20:21 -07:00
mtd	UBI: do not link debug messages when debugging is disabled	2011-08-19 19:02:27 +03:00
net	pptp: pptp_rcv_core() misses pskb_may_pull() call	2011-10-19 03:50:43 -04:00
nfc
nubus
of	Revert "dt: add of_alias_scan and of_alias_get_id"	2011-08-04 11:26:24 +01:00
oprofile
parisc
parport
pci	PCI: Disable MPS configuration by default	2011-10-04 09:52:28 -07:00
pcmcia	Merge git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6	2011-07-31 06:23:08 -10:00
platform	acer-wmi: support Lenovo ideapad S205 wifi switch	2011-08-05 15:21:52 -04:00
pnp
power	s3c-adc-battery: Fix compilation error due to missing header (module.h)	2011-08-19 21:01:46 +04:00
pps
ps3
ptp
rapidio	rapidio: fix use of non-compatible registers	2011-08-25 16:25:34 -07:00
regulator	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6	2011-08-01 14:05:46 -10:00
rtc	drivers/rtc/rtc-s3c.c: fix no occurrence of alarm interrupt	2011-09-14 18:09:38 -07:00
s390	[S390] cio: fix cio_tpi ignoring adapter interrupts	2011-09-26 16:40:50 +02:00
sbus
scsi	[SCSI] libsas: fix panic when single phy is disabled on a wide port	2011-10-02 13:28:55 -05:00
sfi
sh	Merge branch 'common/core' into sh-latest	2011-08-08 16:33:54 +09:00
sn
spi	spi-topcliff-pch: Fix overrun issue	2011-10-04 10:10:50 -06:00
ssb
staging	Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus	2011-10-10 14:39:03 +12:00
target	iscsi-target: Fix sendpage breakage with proper padding+DataDigest iovec offsets	2011-09-16 23:47:07 +00:00
tc
telephony
thermal	thermal: make THERMAL_HWMON implementation fully internal	2011-08-02 14:51:57 -04:00
tty	Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus	2011-10-10 14:39:03 +12:00
uio
usb	USB: xHCI: prevent infinite loop when processing MSE event	2011-09-19 17:15:47 -07:00
uwb
vhost
video	backlight: Declare backlight_types[] const	2011-09-10 14:00:02 -07:00
virt
virtio
vlynq
w1	MAINTAINERS: Evgeniy has moved	2011-08-25 16:25:33 -07:00
watchdog	watchdog: Initconst section fixes for watchdog	2011-09-20 14:32:00 +02:00
xen	xen/irq: Alter the locking to use a mutex instead of a spinlock.	2011-09-15 04:32:02 -04:00
zorro	zorro: Defer device_register() until all devices have been identified	2011-09-22 12:59:35 -07:00
Kconfig
Makefile