netdev - [PATCH] net: Reset skb to network header in neigh_hh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 07 Oct 2016 16:14:46 +0200
From:   Abdelrhman Ahmed <ab@...hmed.com>
To:     "davem" <davem@...emloft.net>
Cc:     "netdev" <netdev@...r.kernel.org>,
        "linux-kernel" <linux-kernel@...r.kernel.org>
Subject: [PATCH] net: Reset skb to network header in neigh_hh_output

When hardware header is added without using cached one, neigh_resolve_output
and neigh_connected_output reset skb to network header before adding it.
When cached one is used, neigh_hh_output does not reset the skb to network
header.

The fix is to reset skb to network header before adding cached hardware header
to keep the behavior consistent in all cases.

Signed-off-by: Abdelrhman Ahmed <ab@...hmed.com>
---
 include/net/neighbour.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 8b68384..4d89fc2 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -424,7 +424,7 @@ static inline struct neighbour * neigh_clone(struct neighbour *neigh)
 static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 {
        unsigned long now = jiffies;
-       
+
        if (neigh->used != now)
                neigh->used = now;
        if (!(neigh->nud_state&(NUD_CONNECTED|NUD_DELAY|NUD_PROBE)))
@@ -451,6 +451,8 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb
        unsigned int seq;
        int hh_len;
 
+       __skb_pull(skb, skb_network_offset(skb));
+
        do {
                seq = read_seqbegin(&hh->hh_lock);
                hh_len = hh->hh_len;
-- 
1.9.1