Skip to contentSkip to conversation

ah: reload pointers to skb data after calling skb_cow_data()

PATCH Applied Nicolas Dichtel 2 participants 2 messages Jan 11, 2011

Subsystems (3)
Networking Network drivers Networking IPsec
lore
Share & tools
lore

Nicolas Dichtel

author
#0 lore raw

PATCH 1/1 ah: reload pointers to skb data after calling skb_cow_data()

Hi,

patch is enclosed.

Regards,
Nicolas

Quoted 1 line

From ba44ef6e00ca0f4c13e425f4a39e8749c56db843 Mon Sep 17 00:00:00 2001

From: Dang Hongwu <[email protected]>
Date: Tue, 11 Jan 2011 12:00:05 -0500
Subject: [PATCH] ah: reload pointers to skb data after calling skb_cow_data()

skb_cow_data() may allocate a new data buffer, so pointers on skb should be set after this function.

Bug was introduced by commit dff3bb06 and 8631e9bd.

Signed-off-by Wang Xuefu <[email protected]>
Acked-by Krzysztof Witek <[email protected]>
Signed-off-by Nicolas Dichtel <[email protected]>
---
 net/ipv4/ah4.c |    7 ++++---
 net/ipv6/ah6.c |    8 +++++---
 2 files changed, 9 insertions(+), 6 deletions(-)
net/ipv4/ah4.c +4 -3
index 880a5ec..86961be 100644
@@ -314,14 +314,15 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
 	skb->ip_summed = CHECKSUM_NONE;
 
-	ah = (struct ip_auth_hdr *)skb->data;
-	iph = ip_hdr(skb);
-	ihl = ip_hdrlen(skb);
 
 	if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
 		goto out;
 	nfrags = err;
 
+	ah = (struct ip_auth_hdr *)skb->data;
+	iph = ip_hdr(skb);
+	ihl = ip_hdrlen(skb);
+
 	work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
 	if (!work_iph)
 		goto out;
net/ipv6/ah6.c +5 -3
index ee82d4e..1aba54a 100644
@@ -538,14 +538,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 	if (!pskb_may_pull(skb, ah_hlen))
 		goto out;
 
-	ip6h = ipv6_hdr(skb);
-
-	skb_push(skb, hdr_len);
 
 	if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
 		goto out;
 	nfrags = err;
 
+	ah = (struct ip_auth_hdr *)skb->data;
+	ip6h = ipv6_hdr(skb);
+
+	skb_push(skb, hdr_len);
+
 	work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
 	if (!work_iph)
 		goto out;
Signature · 1 line
1.5.6.5
maintainer Applied
#1 lore raw

From: Nicolas Dichtel <[email protected]>
Date: Tue, 11 Jan 2011 18:13:33 +0100

Quoted 5 lines
Quoted 1 line

From ba44ef6e00ca0f4c13e425f4a39e8749c56db843 Mon Sep 17 00:00:00 2001

From: Dang Hongwu <[email protected]>
Date: Tue, 11 Jan 2011 12:00:05 -0500
Subject: [PATCH] ah: reload pointers to skb data after calling skb_cow_data()

Quoted 8 lines

skb_cow_data() may allocate a new data buffer, so pointers on skb should be set after this function.

Bug was introduced by commit dff3bb06 and 8631e9bd.

Signed-off-by Wang Xuefu <[email protected]>
Acked-by Krzysztof Witek <[email protected]>
Signed-off-by Nicolas Dichtel <[email protected]>

Applied.