Subject: Re: Fw: [Bug 4279] New: When I try to start vpnc the net/core/skbuff.c:91 crash

From: Patrick McHardy <[email-masked]>
Date: Fri, 11 Mar 2005 06:03:14 +0100

David S. Miller wrote:
>>This check is wrong, gcc optimizes it away:
>>
>>                if ((len -= sizeof(pi)) > len)
>>			return -EINVAL;
>>
>>This could be responsible for the BUG. If len is 2 or 3 and TUN_NO_PI
>>isn't set it underflows. alloc_skb() allocates len + 2, which is 0 or
>>1 byte. skb_reserve tries to reserve 2 bytes and things explode in
>>skb_put.
> 
> Good catch Patrick.
> 
> Patch applied, thanks.

The patch is also needed (and applies with fuzz) for 2.4.

Regards
Patrick