Subject: [patch 1/2] af_iucv: recvmsg: use correct skb_pull() function

From: [email-masked]
Date: Tue, 02 Apr 2013 12:56:51 +0200

From: Hendrik Brueckner <[email-masked]>

When receiving data messages, the "BUG_ON(skb->len < skb->data_len)" in
the skb_pull() function triggers a kernel panic.

Check if the skb uses paged data (is non-linear) and use the pskb_pull()
function.  Use skb_pull() for linear skbs' only.

Reviewed-by: Ursula Braun <[email-masked]>
Signed-off-by: Hendrik Brueckner <[email-masked]>
Signed-off-by: Frank Blaschka <[email-masked]>
---
 net/iucv/af_iucv.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1382,7 +1382,10 @@ static int iucv_sock_recvmsg(struct kioc
 
 		/* SOCK_STREAM: re-queue skb if it contains unreceived data */
 		if (sk->sk_type == SOCK_STREAM) {
-			skb_pull(skb, copied);
+			if (skb_is_nonlinear(skb))
+				pskb_pull(skb, copied);
+			else
+				skb_pull(skb, copied);
 			if (skb->len) {
 				skb_queue_head(&sk->sk_receive_queue, skb);
 				goto done;