Re: [PATCH net-next] vxlan: fix too large pskb_may_pull with remote checksum
From: Tom Herbert <hidden>
Date: 2016-03-16 17:09:39
On Wed, Mar 16, 2016 at 9:35 AM, Jiri Benc [off-list ref] wrote:
The vxlan header is pulled at this point, don't include it again in the calculation.
Hmm, I think I missing something obvious. Where was the pull of the vxlan header done? Thanks, Tom
quoted hunk ↗ jump to hunk
Signed-off-by: Jiri Benc <redacted> --- This was previously part of the VXLAN-GPE patchset but it's not really related (especially not after the discussion that RCO should not be allowed together with GPE). I'm sending it separately. --- drivers/net/vxlan.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c index 800106a7246c..1eb8347f440c 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c@@ -1143,7 +1143,7 @@ static int vxlan_igmp_leave(struct vxlan_dev *vxlan) static bool vxlan_remcsum(struct vxlanhdr *unparsed, struct sk_buff *skb, u32 vxflags) { - size_t start, offset, plen; + size_t start, offset; if (!(unparsed->vx_flags & VXLAN_HF_RCO) || skb->remcsum_offload) goto out;@@ -1151,9 +1151,7 @@ static bool vxlan_remcsum(struct vxlanhdr *unparsed, start = vxlan_rco_start(unparsed->vx_vni); offset = start + vxlan_rco_offset(unparsed->vx_vni); - plen = sizeof(struct vxlanhdr) + offset + sizeof(u16); - - if (!pskb_may_pull(skb, plen)) + if (!pskb_may_pull(skb, offset + sizeof(u16))) return false; skb_remcsum_process(skb, (void *)(vxlan_hdr(skb) + 1), start, offset, --1.8.3.1