[PATCH v3,net-next] ip6_gre: fix a pontential issue in ip6erspan_rcv

Subsystems: networking [general], networking [ipv4/ipv6], the rest

STALE3225d REVIEWED: 1 (0M)

1 review trailer.

2 messages, 2 authors, 2017-12-20 · open the first message on its own page

[PATCH v3,net-next] ip6_gre: fix a pontential issue in ip6erspan_rcv

From: Haishuang Yan <hidden>
Date: 2017-12-20 01:53:58

pskb_may_pull() can change skb->data, so we need to load ipv6h/ershdr at
the right place.

Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
Cc: William Tu <redacted>
Acked-by: William Tu <redacted>
Signed-off-by: Haishuang Yan <redacted>

---
Change since v3:
  * Rebase on latest master branch.
  * Fix wrong commit information.
---
 net/ipv6/ip6_gre.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 87b9892..9bd1103 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -507,12 +507,11 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
 	struct ip6_tnl *tunnel;
 	u8 ver;
 
-	ipv6h = ipv6_hdr(skb);
-	ershdr = (struct erspan_base_hdr *)skb->data;
-
 	if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
 		return PACKET_REJECT;
 
+	ipv6h = ipv6_hdr(skb);
+	ershdr = (struct erspan_base_hdr *)skb->data;
 	ver = (ntohs(ershdr->ver_vlan) & VER_MASK) >> VER_OFFSET;
 	tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
 
-- 
1.8.3.1

Re: [PATCH v3,net-next] ip6_gre: fix a pontential issue in ip6erspan_rcv

From: David Miller <davem@davemloft.net>
Date: 2017-12-20 18:52:50

From: Haishuang Yan <redacted>
Date: Wed, 20 Dec 2017 09:53:19 +0800
pskb_may_pull() can change skb->data, so we need to load ipv6h/ershdr at
the right place.

Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
Cc: William Tu <redacted>
Acked-by: William Tu <redacted>
Signed-off-by: Haishuang Yan <redacted>

---
Change since v3:
  * Rebase on latest master branch.
  * Fix wrong commit information.
Applied.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help