diff options
author | Cong Wang <xiyou.wangcong@gmail.com> | 2020-10-12 16:17:21 -0700 |
---|---|---|
committer | Jakub Kicinski <kuba@kernel.org> | 2020-10-13 18:35:29 -0700 |
commit | fdafed459998e2be0e877e6189b24cb7a0183224 (patch) | |
tree | 7b4f6180adf6214fe2e521460baa4727c7551087 /net/tipc/net.h | |
parent | 4e3bbb33e6f36e4b05be1b1b9b02e3dd5aaa3e69 (diff) | |
download | linux-fdafed459998e2be0e877e6189b24cb7a0183224.tar.bz2 |
ip_gre: set dev->hard_header_len and dev->needed_headroom properly
GRE tunnel has its own header_ops, ipgre_header_ops, and sets it
conditionally. When it is set, it assumes the outer IP header is
already created before ipgre_xmit().
This is not true when we send packets through a raw packet socket,
where L2 headers are supposed to be constructed by user. Packet
socket calls dev_validate_header() to validate the header. But
GRE tunnel does not set dev->hard_header_len, so that check can
be simply bypassed, therefore uninit memory could be passed down
to ipgre_xmit(). Similar for dev->needed_headroom.
dev->hard_header_len is supposed to be the length of the header
created by dev->header_ops->create(), so it should be used whenever
header_ops is set, and dev->needed_headroom should be used when it
is not set.
Reported-and-tested-by: syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com
Cc: William Tu <u9012063@gmail.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/tipc/net.h')
0 files changed, 0 insertions, 0 deletions