Skip to contentSkip to conversation

ipv4: fix a potential use after free in gre_offload.c

PATCH Applied [email protected] 3 participants 3 messages Oct 18, 2014

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 ipv4: fix a potential use after free in gre_offload.c

From: Li RongQing <[email protected]>

pskb_may_pull() may change skb->data and make greh pointer oboslete; so need to reassign greh;
but since first calling pskb_may_pull already ensured that skb->data has enough space for greh, so move the reference of greh before second calling pskb_may_pull(), to avoid reassign greh.

Fixes 7a7ffbabf9("ipv4: fix tunneled VM traffic over hw VXLAN/GRE GSO NIC")
Cc Wei-Chun Chao <[email protected]>
Signed-off-by Li RongQing <[email protected]>
---
 net/ipv4/gre_offload.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv4/gre_offload.c +3 -3
index a777295..ccda096 100644
@@ -55,13 +55,13 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 	if (csum)
 		skb->encap_hdr_csum = 1;
 
-	if (unlikely(!pskb_may_pull(skb, ghl)))
-		goto out;
-
 	/* setup inner skb. */
 	skb->protocol = greh->protocol;
 	skb->encapsulation = 0;
 
+	if (unlikely(!pskb_may_pull(skb, ghl)))
+		goto out;
+
 	__skb_pull(skb, ghl);
 	skb_reset_mac_header(skb);
 	skb_set_network_header(skb, skb_inner_network_offset(skb));
Signature · 1 line
1.7.10.4
Acked-by on v1 1/1
#1 lore raw
Quoted 8 lines · On Sat, 2014-10-18 at 17:26 +0800, [email protected] wrote:

From: Li RongQing <[email protected]>

pskb_may_pull() may change skb->data and make greh pointer oboslete; so need to reassign greh;
but since first calling pskb_may_pull already ensured that skb->data has enough space for greh, so move the reference of greh before second calling pskb_may_pull(), to avoid reassign greh.

Quoted 4 lines
Fixes 7a7ffbabf9("ipv4: fix tunneled VM traffic over hw VXLAN/GRE GSO NIC")
Cc Wei-Chun Chao <[email protected]>
Signed-off-by Li RongQing <[email protected]>

---

Acked-by Eric Dumazet <[email protected]>
maintainer Applied
#2 lore raw
In reply to [email protected]

From: [email protected]
Date: Sat, 18 Oct 2014 17:26:04 +0800

Quoted 11 lines

From: Li RongQing <[email protected]>

pskb_may_pull() may change skb->data and make greh pointer oboslete; so need to reassign greh;
but since first calling pskb_may_pull already ensured that skb->data has enough space for greh, so move the reference of greh before second calling pskb_may_pull(), to avoid reassign greh.

Fixes 7a7ffbabf9("ipv4: fix tunneled VM traffic over hw VXLAN/GRE GSO NIC")
Cc Wei-Chun Chao <[email protected]>
Signed-off-by Li RongQing <[email protected]>

Applied.