Skip to contentSkip to conversation

GSO: Reload iph after pskb_may_pull

PATCH In review Arnaldo Carvalho de Melo 3 participants 3 messages Nov 28, 2016 – Nov 30, 2016

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Arnaldo Carvalho de Melo

author
#0 lore raw

PATCH 1/1 GSO: Reload iph after pskb_may_pull

As it may get stale and lead to use after free.

Acked-by Eric Dumazet <[email protected]>
Cc Alexander Duyck <[email protected]>
Cc Andrey Konovalov <[email protected]>
Fixes cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID")
Signed-off-by Arnaldo Carvalho de Melo <[email protected]>
---
 net/ipv4/af_inet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/af_inet.c +1 -1
index 5ddf5cda07f4..215143246e4b 100644
@@ -1233,7 +1233,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
 		fixedid = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TCP_FIXEDID);
 
 		/* fixed ID is invalid if DF bit is not set */
-		if (fixedid && !(iph->frag_off & htons(IP_DF)))
+		if (fixedid && !(ip_hdr(skb)->frag_off & htons(IP_DF)))
 			goto out;
 	}
Signature · 1 line
2.9.3
Acked-by on v1 1/1
#1 lore raw
Quoted 25 lines · Arnaldo Carvalho de Melo

As it may get stale and lead to use after free.

Acked-by Eric Dumazet <[email protected]>
Cc Alexander Duyck <[email protected]>
Cc Andrey Konovalov <[email protected]>
Fixes cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID")
Signed-off-by Arnaldo Carvalho de Melo <[email protected]>
---
 net/ipv4/af_inet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/af_inet.c +1 -2
index 5ddf5cda07f4..215143246e4b 100644
@@ -1233,7 +1233,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                fixedid = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TCP_FIXEDID);
 
                /* fixed ID is invalid if DF bit is not set */
-               if (fixedid && !(iph->frag_off & htons(IP_DF)))
+               if (fixedid && !(ip_hdr(skb)->frag_off & htons(IP_DF)))
                        goto out;
        }
 
--
Quoted 2 lines

2.9.3

Looks good to me.

Acked-by Alexander Duyck <[email protected]>
maintainer
#2 lore raw
In reply to Arnaldo Carvalho de Melo

From: Arnaldo Carvalho de Melo <[email protected]>
Date: Mon, 28 Nov 2016 12:36:58 -0300

Quoted 7 lines

As it may get stale and lead to use after free.

Acked-by Eric Dumazet <[email protected]>
Cc Alexander Duyck <[email protected]>
Cc Andrey Konovalov <[email protected]>
Fixes cbc53e08a793 ("GSO: Add GSO type for fixed IPv4 ID")
Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Applied and queued up for -stable, thanks Arnaldo!