Commit 4990610d authored by Richard Haines's avatar Richard Haines Committed by Greg Kroah-Hartman

net/ipv6: Fix CALIPSO causing GPF with datagram support


[ Upstream commit e3ebdb20 ]

When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the
IP header may have moved.

Also update the payload length after adding the CALIPSO option.
Signed-off-by: default avatarRichard Haines <richard_c_haines@btinternet.com>
Acked-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarHuw Davies <huw@codeweavers.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 76d36dd1
...@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, ...@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
struct ipv6hdr *ip6_hdr; struct ipv6hdr *ip6_hdr;
struct ipv6_opt_hdr *hop; struct ipv6_opt_hdr *hop;
unsigned char buf[CALIPSO_MAX_BUFFER]; unsigned char buf[CALIPSO_MAX_BUFFER];
int len_delta, new_end, pad; int len_delta, new_end, pad, payload;
unsigned int start, end; unsigned int start, end;
ip6_hdr = ipv6_hdr(skb); ip6_hdr = ipv6_hdr(skb);
...@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, ...@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
if (ret_val < 0) if (ret_val < 0)
return ret_val; return ret_val;
ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
if (len_delta) { if (len_delta) {
if (len_delta > 0) if (len_delta > 0)
skb_push(skb, len_delta); skb_push(skb, len_delta);
...@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, ...@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
sizeof(*ip6_hdr) + start); sizeof(*ip6_hdr) + start);
skb_reset_network_header(skb); skb_reset_network_header(skb);
ip6_hdr = ipv6_hdr(skb); ip6_hdr = ipv6_hdr(skb);
payload = ntohs(ip6_hdr->payload_len);
ip6_hdr->payload_len = htons(payload + len_delta);
} }
hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1); hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment