| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 23 Feb 2013 21:01:01 -0500 (EST) From: David Miller <davem@...emloft.net> To: jesse@...ira.com Cc: amwang@...hat.com, netdev@...r.kernel.org Subject: Re: [PATCH 2/2] vlan: adjust vlan_set_encap_proto() for its callers From: Jesse Gross <jesse@...ira.com> Date: Fri, 22 Feb 2013 17:05:01 -0800 > On Fri, Feb 22, 2013 at 1:32 AM, Cong Wang <amwang@...hat.com> wrote: >> From: Cong Wang <amwang@...hat.com> >> >> There are two places to call vlan_set_encap_proto(): >> vlan_untag() and __pop_vlan_tci(). >> >> vlan_untag() assumes skb->data points after mac addr, otherwise >> the following code >> >> vhdr = (struct vlan_hdr *) skb->data; >> vlan_tci = ntohs(vhdr->h_vlan_TCI); >> __vlan_hwaccel_put_tag(skb, vlan_tci); >> >> skb_pull_rcsum(skb, VLAN_HLEN); >> >> won't be correct. But __pop_vlan_tci() assumes points _before_ >> mac addr. >> >> In vlan_set_encap_proto(), it looks for some magic L2 value >> after mac addr: >> >> rawp = skb->data; >> if (*(unsigned short *) rawp == 0xFFFF) >> ... >> >> Therefore __pop_vlan_tci() is obviously wrong. >> >> A quick fix is avoiding using skb->data in vlan_set_encap_proto(), >> use 'vhdr+1' is always correct in both cases. >> >> Cc: David S. Miller <davem@...emloft.net> >> Cc: Jesse Gross <jesse@...ira.com> >> Signed-off-by: Cong Wang <amwang@...hat.com> > > Acked-by: Jesse Gross <jesse@...ira.com> Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists