diff options
| author | Li RongQing <roy.qing.li@gmail.com> | 2014-10-18 17:33:38 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-10-18 13:04:09 -0400 |
| commit | a6d4518da371b0d21512ef0f641928d6f99ee70f (patch) | |
| tree | d2cd98564a10f6cbf52492765d383f7959f4f001 /net | |
| parent | fc6fb41cd64fd810bcc69fe9776d2f500778f38f (diff) | |
| download | linux-a6d4518da371b0d21512ef0f641928d6f99ee70f.tar.bz2 | |
ipv6: fix a potential use after free in sit.c
pskb_may_pull() maybe change skb->data and make iph pointer oboslete,
fix it by geting ip header length directly.
Fixes: ca15a078 (sit: generate icmpv6 error when receiving icmpv4 error)
Cc: Oussama Ghorbel <ghorbel@pivasoftware.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv6/sit.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 6eab37cf5345..58e5b4710127 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -485,11 +485,11 @@ static void ipip6_tunnel_uninit(struct net_device *dev) */ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) { - const struct iphdr *iph = (const struct iphdr *) skb->data; + int ihl = ((const struct iphdr *)skb->data)->ihl*4; struct rt6_info *rt; struct sk_buff *skb2; - if (!pskb_may_pull(skb, iph->ihl * 4 + sizeof(struct ipv6hdr) + 8)) + if (!pskb_may_pull(skb, ihl + sizeof(struct ipv6hdr) + 8)) return 1; skb2 = skb_clone(skb, GFP_ATOMIC); @@ -498,7 +498,7 @@ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) return 1; skb_dst_drop(skb2); - skb_pull(skb2, iph->ihl * 4); + skb_pull(skb2, ihl); skb_reset_network_header(skb2); rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0); |