Skip to contentSkip to conversation

ipv6: udp: fix the wrong headroom check

PATCH Applied Shan Wei 3 participants 3 messages Apr 20, 2011 – Apr 21, 2011

Subsystems (3)
Networking Network drivers UDP
lore
Share & tools
lore

Shan Wei

author
#0 lore raw

PATCH 1/1 ipv6: udp: fix the wrong headroom check

At this point, skb->data points to skb_transport_header. So, headroom check is wrong.

For some case:bridge(UFO is on) + eth device(UFO is off), there is no enough headroom for IPv6 frag head. But headroom check is always false.

This will bring about data be moved to there prior to skb->head, when adding IPv6 frag header to skb.

Signed-off-by Shan Wei <[email protected]>
---
 net/ipv6/udp.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
net/ipv6/udp.c +1 -1
index 15c3774..9e305d7 100644
@@ -1335,7 +1335,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
 	skb->ip_summed = CHECKSUM_NONE;
 
 	/* Check if there is enough headroom to insert fragment header. */
-	if ((skb_headroom(skb) < frag_hdr_sz) &&
+	if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
 	    pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
 		goto out;
Signature · 1 line
1.6.3.3
Acked-by on v1 1/1
#1 lore raw
Quoted 11 lines · Shan Wei

At this point, skb->data points to skb_transport_header. So, headroom check is wrong.

For some case:bridge(UFO is on) + eth device(UFO is off), there is no enough headroom for IPv6 frag head. But headroom check is always false.

This will bring about data be moved to there prior to skb->head, when adding IPv6 frag header to skb.

Signed-off-by Shan Wei <[email protected]>

Ouch.

Acked-by Herbert Xu <[email protected]>

Thanks,

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
maintainer Applied
#2 lore raw

From: Herbert Xu <[email protected]>
Date: Wed, 20 Apr 2011 18:50:07 +0800

Quoted 8 lines · Shan Wei
Quoted 7 lines

At this point, skb->data points to skb_transport_header. So, headroom check is wrong.

For some case:bridge(UFO is on) + eth device(UFO is off), there is no enough headroom for IPv6 frag head. But headroom check is always false.

Quoted 8 lines
Quoted 4 lines

This will bring about data be moved to there prior to skb->head, when adding IPv6 frag header to skb.

Signed-off-by Shan Wei <[email protected]>

Ouch.

Acked-by Herbert Xu <[email protected]>

Applied, thanks.