mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 11:19:37 +00:00
ipv4: ip_check_defrag must not modify skb before unsharing
ip_check_defrag() might be called from af_packet within the RX path where shared SKBs are used, so it must not modify the input SKB before it has unshared it for defragmentation. Use skb_copy_bits() to get the IP header and only pull in everything later. The same is true for the other caller in macvlan as it is called from dev->rx_handler which can also get a shared SKB. Reported-by: Eric Leblond <eric@regit.org> Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
5e1f54201c
commit
1bf3751ec9
1 changed files with 10 additions and 11 deletions
|
@ -707,28 +707,27 @@ EXPORT_SYMBOL(ip_defrag);
|
|||
|
||||
struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
|
||||
{
|
||||
const struct iphdr *iph;
|
||||
struct iphdr iph;
|
||||
u32 len;
|
||||
|
||||
if (skb->protocol != htons(ETH_P_IP))
|
||||
return skb;
|
||||
|
||||
if (!pskb_may_pull(skb, sizeof(struct iphdr)))
|
||||
if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
|
||||
return skb;
|
||||
|
||||
iph = ip_hdr(skb);
|
||||
if (iph->ihl < 5 || iph->version != 4)
|
||||
return skb;
|
||||
if (!pskb_may_pull(skb, iph->ihl*4))
|
||||
return skb;
|
||||
iph = ip_hdr(skb);
|
||||
len = ntohs(iph->tot_len);
|
||||
if (skb->len < len || len < (iph->ihl * 4))
|
||||
if (iph.ihl < 5 || iph.version != 4)
|
||||
return skb;
|
||||
|
||||
if (ip_is_fragment(ip_hdr(skb))) {
|
||||
len = ntohs(iph.tot_len);
|
||||
if (skb->len < len || len < (iph.ihl * 4))
|
||||
return skb;
|
||||
|
||||
if (ip_is_fragment(&iph)) {
|
||||
skb = skb_share_check(skb, GFP_ATOMIC);
|
||||
if (skb) {
|
||||
if (!pskb_may_pull(skb, iph.ihl*4))
|
||||
return skb;
|
||||
if (pskb_trim_rcsum(skb, len))
|
||||
return skb;
|
||||
memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
|
||||
|
|
Loading…
Reference in a new issue