diff options
| author | Krzysztof Halasa <khc@pm.waw.pl> | 2008-06-29 21:48:11 +0200 |
|---|---|---|
| committer | Jeff Garzik <jgarzik@redhat.com> | 2008-07-04 14:09:39 +0200 |
| commit | 54364b752ef0c91fe92684df000cc4593d1e8963 (patch) | |
| tree | 9f9dc8333666df30b4cadf624d5e617f56d63f4e /drivers/net/wan/hdlc_fr.c | |
| parent | bridge: fix use-after-free in br_cleanup_bridges() (diff) | |
| download | linux-54364b752ef0c91fe92684df000cc4593d1e8963.tar.xz linux-54364b752ef0c91fe92684df000cc4593d1e8963.zip | |
Add missing skb->dev assignment in Frame Relay RX code
Commit 4c13eb6657fe9ef7b4dc8f1a405c902e9e5234e0 ([ETH]: Make
eth_type_trans set skb->dev like the other *_type_trans) removed
skb->dev assignment from hdlc_fr.c:fr_rx(). Unfortunately it was also
needed for cases other than eth_type_trans().
Adding it back.
It's quite serious and may be a security risk as it causes a wrong
input interface indication (the physical hdlcX instead of logical
pvcX). Probably -stable class fix.
Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Diffstat (limited to 'drivers/net/wan/hdlc_fr.c')
| -rw-r--r-- | drivers/net/wan/hdlc_fr.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c index 520bb0b1a9a2..6d35155c7145 100644 --- a/drivers/net/wan/hdlc_fr.c +++ b/drivers/net/wan/hdlc_fr.c @@ -1008,6 +1008,7 @@ static int fr_rx(struct sk_buff *skb) stats->rx_bytes += skb->len; if (pvc->state.becn) stats->rx_compressed++; + skb->dev = dev; netif_rx(skb); return NET_RX_SUCCESS; } else { |