Florian Westphal 6e56830776 atl1c: reserve min skb headroom ... Got crash report with following backtrace: BUG: unable to handle kernel paging request at ffff8801869daffe RIP: 0010:[<ffffffff816429c4>] [<ffffffff816429c4>] ip6_finish_output2+0x394/0x4c0 RSP: 0018:ffff880186c83a98 EFLAGS: 00010283 RAX: ffff8801869db00e ... [<ffffffff81644cdc>] ip6_finish_output+0x8c/0xf0 [<ffffffff81644d97>] ip6_output+0x57/0x100 [<ffffffff81643dc9>] ip6_forward+0x4b9/0x840 [<ffffffff81645566>] ip6_rcv_finish+0x66/0xc0 [<ffffffff81645db9>] ipv6_rcv+0x319/0x530 [<ffffffff815892ac>] netif_receive_skb+0x1c/0x70 [<ffffffffc0060bec>] atl1c_clean+0x1ec/0x310 [atl1c] ... The bad access is in neigh_hh_output(), at skb->data - 16 (HH_DATA_MOD). atl1c driver provided skb with no headroom, so 14 bytes (ethernet header) got pulled, but then 16 are copied. Reserve NET_SKB_PAD bytes headroom, like netdev_alloc_skb(). Compile tested only; I lack hardware. Fixes: 7b70176421 ("atl1c: Fix misuse of netdev_alloc_skb in refilling rx ring") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-07-22 10:28:26 -07:00
..
atl1c_ethtool.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
atl1c_hw.c	scripts/spelling.txt: add regsiter -> register spelling mistake	2017-05-08 17:15:13 -07:00
atl1c_hw.h	atl1c: fix issue of io access mode for AR8152 v2.1	2012-07-20 11:21:18 -07:00
atl1c_main.c	atl1c: reserve min skb headroom	2018-07-22 10:28:26 -07:00
atl1c.h	atl1c: remove private tx lock	2016-04-26 15:53:04 -04:00
Makefile