| Message ID | 4A4D7425.7080005@cn.fujitsu.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Fri, Jul 03, 2009 at 10:59:49AM +0800, Wei Yongjun wrote: > The SCTP pushed the skb above the sctp chunk header, so the > check of pskb_may_pull(skb, nh + offset + 1 - skb->data) in > _decode_session6() will never return 0 and the ports decode > of sctp will always fail. (nh + offset + 1 - skb->data < 0) > > Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
From: Herbert Xu <herbert@gondor.apana.org.au> Date: Fri, 3 Jul 2009 11:49:17 +0800 > On Fri, Jul 03, 2009 at 10:59:49AM +0800, Wei Yongjun wrote: >> The SCTP pushed the skb above the sctp chunk header, so the >> check of pskb_may_pull(skb, nh + offset + 1 - skb->data) in >> _decode_session6() will never return 0 and the ports decode >> of sctp will always fail. (nh + offset + 1 - skb->data < 0) >> >> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> > > Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c index b4b16a4..3a3c677 100644 --- a/net/ipv6/xfrm6_policy.c +++ b/net/ipv6/xfrm6_policy.c @@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr); ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr); - while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) { + while (nh + offset + 1 < skb->data || + pskb_may_pull(skb, nh + offset + 1 - skb->data)) { nh = skb_network_header(skb); exthdr = (struct ipv6_opt_hdr *)(nh + offset); @@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) case IPPROTO_TCP: case IPPROTO_SCTP: case IPPROTO_DCCP: - if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) { + if (!onlyproto && (nh + offset + 4 < skb->data || + pskb_may_pull(skb, nh + offset + 4 - skb->data))) { __be16 *ports = (__be16 *)exthdr; fl->fl_ip_sport = ports[!!reverse];
The SCTP pushed the skb above the sctp chunk header, so the check of pskb_may_pull(skb, nh + offset + 1 - skb->data) in _decode_session6() will never return 0 and the ports decode of sctp will always fail. (nh + offset + 1 - skb->data < 0) Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> --- net/ipv6/xfrm6_policy.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)