Message ID | 20161128153658.GB4778@kernel.org |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
On Mon, Nov 28, 2016 at 7:36 AM, Arnaldo Carvalho de Melo <acme@kernel.org> wrote: > As it may get stale and lead to use after free. > > Acked-by: Eric Dumazet <eric.dumazet@gmail.com> > Cc: Alexander Duyck <aduyck@mirantis.com> > Cc: Andrey Konovalov <andreyknvl@google.com> > Fixes: cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID") > Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> > --- > net/ipv4/af_inet.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c > index 5ddf5cda07f4..215143246e4b 100644 > --- a/net/ipv4/af_inet.c > +++ b/net/ipv4/af_inet.c > @@ -1233,7 +1233,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, > fixedid = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TCP_FIXEDID); > > /* fixed ID is invalid if DF bit is not set */ > - if (fixedid && !(iph->frag_off & htons(IP_DF))) > + if (fixedid && !(ip_hdr(skb)->frag_off & htons(IP_DF))) > goto out; > } > > -- > 2.9.3 > Looks good to me. Acked-by: Alexander Duyck <alexander.h.duyck@intel.com>
From: Arnaldo Carvalho de Melo <acme@kernel.org> Date: Mon, 28 Nov 2016 12:36:58 -0300 > As it may get stale and lead to use after free. > > Acked-by: Eric Dumazet <eric.dumazet@gmail.com> > Cc: Alexander Duyck <aduyck@mirantis.com> > Cc: Andrey Konovalov <andreyknvl@google.com> > Fixes: cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID") > Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Applied and queued up for -stable, thanks Arnaldo!
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 5ddf5cda07f4..215143246e4b 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -1233,7 +1233,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, fixedid = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TCP_FIXEDID); /* fixed ID is invalid if DF bit is not set */ - if (fixedid && !(iph->frag_off & htons(IP_DF))) + if (fixedid && !(ip_hdr(skb)->frag_off & htons(IP_DF))) goto out; }