netdev - Re: ipv6: fix headroom calculation in udp6_ufo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131213141227.GC7332@order.stressinduktion.org>
Date:	Fri, 13 Dec 2013 15:12:27 +0100
From:	Hannes Frederic Sowa <hannes@...essinduktion.org>
To:	Mark Brown <broonie@...nel.org>
Cc:	Mark Hambleton <mark.hambleton@...adcom.com>,
	'Pravin B Shelar' <pshelar@...ira.com>,
	'Saran Neti' <Saran.Neti@...us.com>,
	"'David S. Miller'" <davem@...emloft.net>,
	'Greg Kroah-Hartman' <gregkh@...uxfoundation.org>,
	"'netdev@...r.kernel.org'" <netdev@...r.kernel.org>,
	"'stable@...r.kernel.org'" <stable@...r.kernel.org>
Subject: Re: ipv6: fix headroom calculation in udp6_ufo_fragment

On Fri, Dec 13, 2013 at 01:42:05PM +0000, Mark Brown wrote:
> On Fri, Dec 13, 2013 at 02:34:53PM +0100, Hannes Frederic Sowa wrote:
> 
> > Sorry, I don't know which version the LTS kernel is. Upstream does not use
> > sk_buff_data_t for mac_header any more.
> 
> This is with v3.10.

The change happend in 3.11. So I guess it was an oversight while backporting.
Following patch should help and should get backported to all stable kernels
<= 3.10.

[PATCH stable] ipv6: fix illegal mac_header comparison on 32bit

Signed-off-by: Hannes Frederic Sowa <hannes@...essinduktion.org>
---

Patch intended for stable kernel <= 3.10.

 net/ipv6/udp_offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index e7359f9..e15a357 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -90,7 +90,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
 
 		/* Check if there is enough headroom to insert fragment header. */
 		tnl_hlen = skb_tnl_header_len(skb);
-		if (skb->mac_header < (tnl_hlen + frag_hdr_sz)) {
+		if (skb_mac_header(skb) < skb->head + tnl_hlen + frag_hdr_sz) {
 			if (gso_pskb_expand_head(skb, tnl_hlen + frag_hdr_sz))
 				goto out;
 		}
-- 
1.8.3.1



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html