| Message ID | 1513734799-20879-1-git-send-email-yanhaishuang@cmss.chinamobile.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [v3,net-next] ip6_gre: fix a pontential issue in ip6erspan_rcv | expand |
From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com> Date: Wed, 20 Dec 2017 09:53:19 +0800 > pskb_may_pull() can change skb->data, so we need to load ipv6h/ershdr at > the right place. > > Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support") > Cc: William Tu <u9012063@gmail.com> > Acked-by: William Tu <u9012063@gmail.com> > Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com> > > --- > Change since v3: > * Rebase on latest master branch. > * Fix wrong commit information. Applied.
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c index 87b9892..9bd1103 100644 --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -507,12 +507,11 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len, struct ip6_tnl *tunnel; u8 ver; - ipv6h = ipv6_hdr(skb); - ershdr = (struct erspan_base_hdr *)skb->data; - if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr)))) return PACKET_REJECT; + ipv6h = ipv6_hdr(skb); + ershdr = (struct erspan_base_hdr *)skb->data; ver = (ntohs(ershdr->ver_vlan) & VER_MASK) >> VER_OFFSET; tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
pskb_may_pull() can change skb->data, so we need to load ipv6h/ershdr at the right place. Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support") Cc: William Tu <u9012063@gmail.com> Acked-by: William Tu <u9012063@gmail.com> Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com> --- Change since v3: * Rebase on latest master branch. * Fix wrong commit information. --- net/ipv6/ip6_gre.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)