iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipv6: fix a potential use after free in sit.c

Browse Source 
pskb_may_pull() maybe change skb->data and make iph pointer oboslete,
fix it by geting ip header length directly.

Fixes: ca15a078 (sit: generate icmpv6 error when receiving icmpv4 error)
Cc: Oussama Ghorbel <ghorbel@pivasoftware.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Li RongQing 2014-10-18 17:33:38 +08:00 committed by David S. Miller
parent fc6fb41cd6
commit a6d4518da3
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/ipv6/sit.c
View File

@ -485,11 +485,11 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
*/ */
static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb) static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)
{ {
const struct iphdr *iph = (const struct iphdr *) skb->data; int ihl = ((const struct iphdr *)skb->data)->ihl*4;
struct rt6_info *rt; struct rt6_info *rt;
struct sk_buff *skb2; struct sk_buff *skb2;
if (!pskb_may_pull(skb, iph->ihl * 4 + sizeof(struct ipv6hdr) + 8)) if (!pskb_may_pull(skb, ihl + sizeof(struct ipv6hdr) + 8))
return 1; return 1;
skb2 = skb_clone(skb, GFP_ATOMIC); skb2 = skb_clone(skb, GFP_ATOMIC);
@ -498,7 +498,7 @@ static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)
return 1; return 1;
skb_dst_drop(skb2); skb_dst_drop(skb2);
skb_pull(skb2, iph->ihl * 4); skb_pull(skb2, ihl);
skb_reset_network_header(skb2); skb_reset_network_header(skb2);
rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0); rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0);