Re: [PATCH] cls_u32: use skb_copy_bits() to dereference data safely
From: David Miller <davem@davemloft.net>
Date: 2010-06-02 12:45:11
From: jamal <redacted> Date: Wed, 02 Jun 2010 08:25:38 -0400
quoted hunk ↗ jump to hunk
--- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c@@ -135,6 +135,9 @@ next_knode: for (i = n->sel.nkeys; i>0; i--, key++) { + int toff = key->off+(off2&key->offmask)- 4; + if (unlikely(toff > skb->len)) + /* bailout here - needs some thought */ if ((*(__be32*)(ptr+key->off+(off2&key->offmask))^key->v
I don't think it's that simple. You can't dereference from the skb->data linear area if your offset is beyond "skb->len - skb->data_len" (aka. skb_headlen()) since that's where the paged or fragmented portion starts. We really need to use skb_copy_bits() if we want to allow any offset into the SKB, and because of all the ways packets can be transformed and constructed we absolutely have to.