From patchwork Wed Mar 16 16:35:47 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Benc X-Patchwork-Id: 598522 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3qQHDT66Gpz9t5T for ; Thu, 17 Mar 2016 03:36:09 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755379AbcCPQgH (ORCPT ); Wed, 16 Mar 2016 12:36:07 -0400 Received: from mx1.redhat.com ([209.132.183.28]:44210 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755316AbcCPQgG (ORCPT ); Wed, 16 Mar 2016 12:36:06 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id EF29064D08; Wed, 16 Mar 2016 16:36:05 +0000 (UTC) Received: from griffin.upir.cz (ovpn-204-77.brq.redhat.com [10.40.204.77]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u2GGa4OQ030854; Wed, 16 Mar 2016 12:36:04 -0400 From: Jiri Benc To: netdev@vger.kernel.org Cc: Tom Herbert Subject: [PATCH net-next] vxlan: fix too large pskb_may_pull with remote checksum Date: Wed, 16 Mar 2016 17:35:47 +0100 Message-Id: X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Wed, 16 Mar 2016 16:36:06 +0000 (UTC) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The vxlan header is pulled at this point, don't include it again in the calculation. Signed-off-by: Jiri Benc --- This was previously part of the VXLAN-GPE patchset but it's not really related (especially not after the discussion that RCO should not be allowed together with GPE). I'm sending it separately. --- drivers/net/vxlan.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c index 800106a7246c..1eb8347f440c 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -1143,7 +1143,7 @@ static int vxlan_igmp_leave(struct vxlan_dev *vxlan) static bool vxlan_remcsum(struct vxlanhdr *unparsed, struct sk_buff *skb, u32 vxflags) { - size_t start, offset, plen; + size_t start, offset; if (!(unparsed->vx_flags & VXLAN_HF_RCO) || skb->remcsum_offload) goto out; @@ -1151,9 +1151,7 @@ static bool vxlan_remcsum(struct vxlanhdr *unparsed, start = vxlan_rco_start(unparsed->vx_vni); offset = start + vxlan_rco_offset(unparsed->vx_vni); - plen = sizeof(struct vxlanhdr) + offset + sizeof(u16); - - if (!pskb_may_pull(skb, plen)) + if (!pskb_may_pull(skb, offset + sizeof(u16))) return false; skb_remcsum_process(skb, (void *)(vxlan_hdr(skb) + 1), start, offset,