| Message ID | 20120712.011049.831106026936792516.davem@davemloft.net |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Thu, 12 Jul 2012 01:10:49 -0700 (PDT) David Miller <davem@davemloft.net> wrote: > > And thus, we can remove the ping_err() hack. > > Signed-off-by: David S. Miller <davem@davemloft.net> > --- > net/ipv4/icmp.c | 8 +------- > 1 file changed, 1 insertion(+), 7 deletions(-) > > diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c > index 18e39d1..5885146 100644 > --- a/net/ipv4/icmp.c > +++ b/net/ipv4/icmp.c > @@ -782,13 +782,7 @@ static void icmp_redirect(struct sk_buff *skb) > break; > } > > - /* Ping wants to see redirects. > - * Let's pretend they are errors of sorts... */ > - if (iph->protocol == IPPROTO_ICMP && > - iph->ihl >= 5 && > - pskb_may_pull(skb, (iph->ihl<<2)+8)) { > - ping_err(skb, icmp_hdr(skb)->un.gateway); > - } > + icmp_socket_deliver(skb, icmp_hdr(skb)->un.gateway); icmp_redirect() just checks skb->len is larger than sizeof(struct iphdr) and then ping_err() is called. In ping_err(), *icmph is derived from following code without sanity check of skb->len. So, I think avobe deleted checks about skb->len need to move to ping_err() in case of packets are malformed. struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2)) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 18e39d1..5885146 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -782,13 +782,7 @@ static void icmp_redirect(struct sk_buff *skb) break; } - /* Ping wants to see redirects. - * Let's pretend they are errors of sorts... */ - if (iph->protocol == IPPROTO_ICMP && - iph->ihl >= 5 && - pskb_may_pull(skb, (iph->ihl<<2)+8)) { - ping_err(skb, icmp_hdr(skb)->un.gateway); - } + icmp_socket_deliver(skb, icmp_hdr(skb)->un.gateway); out: return;
And thus, we can remove the ping_err() hack. Signed-off-by: David S. Miller <davem@davemloft.net> --- net/ipv4/icmp.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)