diff mbox

[net-next] fix buf of assigning skb->tail to network_header

Message ID 1362908909-45697-1-git-send-email-honkiko@gmail.com
State Rejected, archived
Delegated to: David Miller
Headers show

Commit Message

Hong zhi guo March 10, 2013, 9:48 a.m. UTC 
in the case of NET_SKBUFF_DATA_USES_OFFSET,  direct pointer
assignment to skb->network_header is a dangerous bug.

Signed-off-by: Hong Zhiguo <honkiko@gmail.com>
---
 net/ipv4/ipmr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Eric Dumazet March 10, 2013, 9:58 a.m. UTC | #1 
On Sun, 2013-03-10 at 17:48 +0800, Hong Zhiguo wrote:
> in the case of NET_SKBUFF_DATA_USES_OFFSET,  direct pointer
> assignment to skb->network_header is a dangerous bug.

But skb->tail is not a pointer.

Really you need to explain more than this confusing changelog


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 5f95b3a..553409b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -980,7 +980,7 @@  static int ipmr_cache_report(struct mr_table *mrt,
 
 	/* Copy the IP header */
 
-	skb->network_header = skb->tail;
+	skb_set_network_header(skb, skb->tail - skb->data);
 	skb_put(skb, ihl);
 	skb_copy_to_linear_data(skb, pkt->data, ihl);
 	ip_hdr(skb)->protocol = 0;	/* Flag to the kernel this is a route add */