2017-12-16 02:26:36

by Haishuang Yan

Subject: [PATCH v2,net-next] ip6_gre: fix a pontential issue in ip6erspan_rcv

pskb_may_pull() can change skb->data, so we need to load ipv6h/ershdr at
the right place.

Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
Acked-by: William Tu <[email protected]>
Cc: William Tu <[email protected]>
Signed-off-by: Haishuang Yan <[email protected]>

---
Change since v2:
* Rebase on latest master.
---
net/ipv6/ip6_gre.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index f210f9c..aa1512e 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -507,12 +507,11 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
struct ip6_tnl *tunnel;
u8 ver;

- ipv6h = ipv6_hdr(skb);
- ershdr = (struct erspan_base_hdr *)skb->data;
-
if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
return PACKET_REJECT;

+ ipv6h = ipv6_hdr(skb);
+ ershdr = (struct erspan_base_hdr *)skb->data;
ver = (ntohs(ershdr->ver_vlan) & VER_MASK) >> VER_OFFSET;
tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
pkt_md = (struct erspan_metadata *)(ershdr + 1);
--
1.8.3.1

2017-12-19 15:35:12

by David Miller

Subject: Re: [PATCH v2,net-next] ip6_gre: fix a pontential issue in ip6erspan_rcv

From: Haishuang Yan <[email protected]>
Date: Sat, 16 Dec 2017 10:25:25 +0800

> pskb_may_pull() can change skb->data, so we need to load ipv6h/ershdr at
> the right place.
>
> Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
> Acked-by: William Tu <[email protected]>
> Cc: William Tu <[email protected]>
> Signed-off-by: Haishuang Yan <[email protected]>

This patch does not apply:

> + ipv6h = ipv6_hdr(skb);
> + ershdr = (struct erspan_base_hdr *)skb->data;
> ver = (ntohs(ershdr->ver_vlan) & VER_MASK) >> VER_OFFSET;
> tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
> pkt_md = (struct erspan_metadata *)(ershdr + 1);

There is not "pkt_md = ..." assignment in net-next on this line.

2017-12-20 01:27:44

by Haishuang Yan

Subject: Re: [PATCH v2,net-next] ip6_gre: fix a pontential issue in ip6erspan_rcv

> On 2017??12??19??, at ????11:34, David Miller <[email protected]> wrote:
>
> From: Haishuang Yan <[email protected]>
> Date: Sat, 16 Dec 2017 10:25:25 +0800
>
>> pskb_may_pull() can change skb->data, so we need to load ipv6h/ershdr at
>> the right place.
>>
>> Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support")
>> Acked-by: William Tu <[email protected]>
>> Cc: William Tu <[email protected]>
>> Signed-off-by: Haishuang Yan <[email protected]>
>
> This patch does not apply:
>
>> + ipv6h = ipv6_hdr(skb);
>> + ershdr = (struct erspan_base_hdr *)skb->data;
>> ver = (ntohs(ershdr->ver_vlan) & VER_MASK) >> VER_OFFSET;
>> tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
>> pkt_md = (struct erspan_metadata *)(ershdr + 1);
>
> There is not "pkt_md = ..." assignment in net-next on this line.
>

Okay, I will fix it and resubmit another commit, thanks.