netdev - Re: [PATCH] ip6_gre: reload ipv6h in prepare_ip6gre_xmit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190724154446.GA13067@gmail.com>
Date:   Wed, 24 Jul 2019 08:44:46 -0700
From:   William Tu <u9012063@...il.com>
To:     Haishuang Yan <yanhaishuang@...s.chinamobile.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ip6_gre: reload ipv6h in prepare_ip6gre_xmit_ipv6

On Wed, Jul 24, 2019 at 08:00:42PM +0800, Haishuang Yan wrote:
> Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull()
> which may change skb->data, so we need to re-load ipv6h at
> the right place.
> 
> Fixes: 898b29798e36 ("ip6_gre: Refactor ip6gre xmit codes")
> Cc: William Tu <u9012063@...il.com>
> Signed-off-by: Haishuang Yan <yanhaishuang@...s.chinamobile.com>

LGTM, thanks for the fix
Acked-by: William Tu <u9012063@...il.com>

> ---
>  net/ipv6/ip6_gre.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
> index c2049c7..dd2d0b96 100644
> --- a/net/ipv6/ip6_gre.c
> +++ b/net/ipv6/ip6_gre.c
> @@ -660,12 +660,13 @@ static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb,
>  				    struct flowi6 *fl6, __u8 *dsfield,
>  				    int *encap_limit)
>  {
> -	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
> +	struct ipv6hdr *ipv6h;
>  	struct ip6_tnl *t = netdev_priv(dev);
>  	__u16 offset;
>  
>  	offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
>  	/* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
> +	ipv6h = ipv6_hdr(skb);
>  
>  	if (offset > 0) {
>  		struct ipv6_tlv_tnl_enc_lim *tel;
> -- 
> 1.8.3.1
> 
> 
>