]>
Commit | Line | Data |
---|---|---|
7cae96e4 GKH |
1 | From foo@baz Tue Oct 16 16:47:53 CEST 2018 |
2 | From: Paolo Abeni <pabeni@redhat.com> | |
3 | Date: Mon, 24 Sep 2018 15:48:19 +0200 | |
4 | Subject: ip_tunnel: be careful when accessing the inner header | |
5 | ||
6 | From: Paolo Abeni <pabeni@redhat.com> | |
7 | ||
8 | [ Upstream commit ccfec9e5cb2d48df5a955b7bf47f7782157d3bc2] | |
9 | ||
10 | Cong noted that we need the same checks introduced by commit 76c0ddd8c3a6 | |
11 | ("ip6_tunnel: be careful when accessing the inner header") | |
12 | even for ipv4 tunnels. | |
13 | ||
14 | Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") | |
15 | Suggested-by: Cong Wang <xiyou.wangcong@gmail.com> | |
16 | Signed-off-by: Paolo Abeni <pabeni@redhat.com> | |
17 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
18 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
19 | --- | |
20 | net/ipv4/ip_tunnel.c | 9 +++++++++ | |
21 | 1 file changed, 9 insertions(+) | |
22 | ||
23 | --- a/net/ipv4/ip_tunnel.c | |
24 | +++ b/net/ipv4/ip_tunnel.c | |
25 | @@ -597,6 +597,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, | |
26 | const struct iphdr *tnl_params, u8 protocol) | |
27 | { | |
28 | struct ip_tunnel *tunnel = netdev_priv(dev); | |
29 | + unsigned int inner_nhdr_len = 0; | |
30 | const struct iphdr *inner_iph; | |
31 | struct flowi4 fl4; | |
32 | u8 tos, ttl; | |
33 | @@ -607,6 +608,14 @@ void ip_tunnel_xmit(struct sk_buff *skb, | |
34 | int err; | |
35 | bool connected; | |
36 | ||
37 | + /* ensure we can access the inner net header, for several users below */ | |
38 | + if (skb->protocol == htons(ETH_P_IP)) | |
39 | + inner_nhdr_len = sizeof(struct iphdr); | |
40 | + else if (skb->protocol == htons(ETH_P_IPV6)) | |
41 | + inner_nhdr_len = sizeof(struct ipv6hdr); | |
42 | + if (unlikely(!pskb_may_pull(skb, inner_nhdr_len))) | |
43 | + goto tx_error; | |
44 | + | |
45 | inner_iph = (const struct iphdr *)skb_inner_network_header(skb); | |
46 | connected = (tunnel->parms.iph.daddr != 0); | |
47 |