Skip to contentSkip to conversation

yet another IPX nonlinear receive fix

PATCH Applied Stephen Hemminger 2 participants 2 messages Aug 8, 2006

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Stephen Hemminger

author
#0 lore raw

PATCH 1/1 yet another IPX nonlinear receive fix

Need to check some more cases in IPX receive.
If the skb is purely fragments, the IPX header needs to be extracted. The function pskb_may_pull() may in theory invalidate all the pointers in the skb, so references to ipx header must be refreshed.

Signed-off-by Stephen Hemminger <[email protected]>

---

 net/ipx/af_ipx.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

675a6798f7a587cae7acf1ad795366ee201e1a41

net/ipx/af_ipx.c +5 -2
index c13e86b..4019642 100644
@@ -1642,14 +1642,17 @@ static int ipx_rcv(struct sk_buff *skb, 
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		goto out;
 
-	ipx		= ipx_hdr(skb);
-	ipx_pktsize	= ntohs(ipx->ipx_pktsize);
+	if (!pskb_may_pull(skb, sizeof(struct ipxhdr)))
+		goto drop;
+
+	ipx_pktsize = ntohs(ipxhdr(skb)->ipx_pktsize);
 	
 	/* Too small or invalid header? */
 	if (ipx_pktsize < sizeof(struct ipxhdr) ||
 	    !pskb_may_pull(skb, ipx_pktsize))
 		goto drop;
                         
+	ipx = ipx_hdr(skb);
 	if (ipx->ipx_checksum != IPX_NO_CHECKSUM &&
 	   ipx->ipx_checksum != ipx_cksum(ipx, ipx_pktsize))
 		goto drop;
Signature · 1 line
1.2.4
maintainer Applied
#1 lore raw

From: Stephen Hemminger <[email protected]>
Date: Tue, 8 Aug 2006 16:18:24 -0700

Quoted 7 lines

Need to check some more cases in IPX receive.
If the skb is purely fragments, the IPX header needs to be extracted. The function pskb_may_pull() may in theory invalidate all the pointers in the skb, so references to ipx header must be refreshed.

Signed-off-by Stephen Hemminger <[email protected]>

Applied, thanks Stephen.