From patchwork Tue Nov 8 22:12:45 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nick Bowler X-Patchwork-Id: 124444 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 7EA101007D4 for ; Wed, 9 Nov 2011 09:13:44 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756447Ab1KHWNH (ORCPT ); Tue, 8 Nov 2011 17:13:07 -0500 Received: from dsl-67-204-24-19.acanac.net ([67.204.24.19]:35488 "EHLO mail.ellipticsemi.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756376Ab1KHWNF (ORCPT ); Tue, 8 Nov 2011 17:13:05 -0500 Received: from nbowler by mail.ellipticsemi.com with local (Exim 4.76) (envelope-from ) id 1RNtue-0007aq-PY; Tue, 08 Nov 2011 17:13:00 -0500 From: Nick Bowler To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: "David S. Miller" Subject: [PATCH 2/2] ah: Read nexthdr value before overwriting it in ahash input callback. Date: Tue, 8 Nov 2011 17:12:45 -0500 Message-Id: <1320790365-29152-3-git-send-email-nbowler@elliptictech.com> X-Mailer: git-send-email 1.7.3.4 In-Reply-To: <1320790365-29152-1-git-send-email-nbowler@elliptictech.com> References: <1320790365-29152-1-git-send-email-nbowler@elliptictech.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The AH4/6 ahash input callbacks read out the nexthdr field from the AH header *after* they overwrite that header. This is obviously not going to end well. Fix it up. Signed-off-by: Nick Bowler --- net/ipv4/ah4.c | 4 ++-- net/ipv6/ah6.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c index 33ca186..c7056b2 100644 --- a/net/ipv4/ah4.c +++ b/net/ipv4/ah4.c @@ -262,12 +262,12 @@ static void ah_input_done(struct crypto_async_request *base, int err) if (err) goto out; + err = ah->nexthdr; + skb->network_header += ah_hlen; memcpy(skb_network_header(skb), work_iph, ihl); __skb_pull(skb, ah_hlen + ihl); skb_set_transport_header(skb, -ihl); - - err = ah->nexthdr; out: kfree(AH_SKB_CB(skb)->tmp); xfrm_input_resume(skb, err); diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c index ede4d9d..7a33aaa 100644 --- a/net/ipv6/ah6.c +++ b/net/ipv6/ah6.c @@ -464,12 +464,12 @@ static void ah6_input_done(struct crypto_async_request *base, int err) if (err) goto out; + err = ah->nexthdr; + skb->network_header += ah_hlen; memcpy(skb_network_header(skb), work_iph, hdr_len); __skb_pull(skb, ah_hlen + hdr_len); skb_set_transport_header(skb, -hdr_len); - - err = ah->nexthdr; out: kfree(AH_SKB_CB(skb)->tmp); xfrm_input_resume(skb, err);