diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2014-11-30 05:03:31 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-12-02 23:53:47 -0500 |
| commit | d8febb77b52ebddb9bd03ccaa5b61005e3a45a85 (patch) | |
| tree | 1ce3bd20619b430fbc357715fd7eaa8c190e045d | |
| parent | cbc24658baac5ca96d20d4a6ca9a8c41581a6e63 (diff) | |
tun: Fix GSO meta-data handling in tun_get_user
When we write the GSO meta-data in tun_get_user we end up advancing
the IO vector twice, thus exhausting the user buffer before we can
finish writing the packet.
Fixes: f5ff53b4d97c ("{macvtap,tun}_get_user(): switch to iov_iter")
Reported-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/tun.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 4b743c612624..6d44da184594 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c | |||
| @@ -1052,7 +1052,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, | |||
| 1052 | 1052 | ||
| 1053 | if (gso.hdr_len > len) | 1053 | if (gso.hdr_len > len) |
| 1054 | return -EINVAL; | 1054 | return -EINVAL; |
| 1055 | iov_iter_advance(from, tun->vnet_hdr_sz); | 1055 | iov_iter_advance(from, tun->vnet_hdr_sz - sizeof(gso)); |
| 1056 | } | 1056 | } |
| 1057 | 1057 | ||
| 1058 | if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) { | 1058 | if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) { |