[PPP]: handle misaligned accesses

From: "Philippe De Muyter" <phdm@macqel.be>

This patch avoids ppp-generated kernel crashes on machines where unaligned
accesses are forbidden (ie: m68000), by fixing ppp alignment setting for
reused skb's.

Signed-off-by: Philippe De Muyter <phdm@macqel.be>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 14 insertions, 3 deletions

diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 59e8183c639e..400f652282d7 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -31,6 +31,7 @@
 #include <linux/spinlock.h>
 #include <linux/init.h>
 #include <asm/uaccess.h>
+#include <asm/string.h>
 
 #define PPP_VERSION     "2.4.2"
 
@@ -835,8 +836,11 @@ process_input_packet(struct asyncppp *ap)
  err:
         /* frame had an error, remember that, reset SC_TOSS & SC_ESCAPE */
         ap->state = SC_PREV_ERROR;
-        if (skb)
+        if (skb) {
+                /* make skb appear as freshly allocated */
                 skb_trim(skb, 0);
+                skb_reserve(skb, - skb_headroom(skb));
+        }
 }
 
 /* Called when the tty driver has data for us. Runs parallel with the
@@ -889,10 +893,17 @@ ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
                                 skb = dev_alloc_skb(ap->mru + PPP_HDRLEN + 2);
                                 if (skb == 0)
                                         goto nomem;
-                                /* Try to get the payload 4-byte aligned */
+                                ap->rpkt = skb;
+                        }
+                        if (skb->len == 0) {
+                                /* Try to get the payload 4-byte aligned.
+                                 * This should match the
+                                 * PPP_ALLSTATIONS/PPP_UI/compressed tests in
+                                 * process_input_packet, but we do not have
+                                 * enough chars here to test buf[1] and buf[2].
+                                 */
                                 if (buf[0] != PPP_ALLSTATIONS)
                                         skb_reserve(skb, 2 + (buf[0] & 1));
-                                ap->rpkt = skb;
                         }
                         if (n > skb_tailroom(skb)) {
                                 /* packet overflowed MRU */