diff options
author | Richard Haines <richard_c_haines@btinternet.com> | 2017-06-05 16:44:40 +0100 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-06-14 15:05:52 +0200 |
commit | a97f807363d4f3c8c849a0e12064305d5bb5a6dc (patch) | |
tree | 321507bb552580aeb51fffff83e75c80251b77bf /net/ipv6 | |
parent | 0aa89f1b07de1e8a54f9073b0a48266e864c647e (diff) | |
download | linux-stable-a97f807363d4f3c8c849a0e12064305d5bb5a6dc.tar.gz linux-stable-a97f807363d4f3c8c849a0e12064305d5bb5a6dc.tar.bz2 linux-stable-a97f807363d4f3c8c849a0e12064305d5bb5a6dc.zip |
net/ipv6: Fix CALIPSO causing GPF with datagram support
[ Upstream commit e3ebdb20fddacded2740a333ff66781e0d28b05c ]
When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the
IP header may have moved.
Also update the payload length after adding the CALIPSO option.
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/ipv6')
-rw-r--r-- | net/ipv6/calipso.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c index 37ac9de713c6..8d772fea1dde 100644 --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, struct ipv6hdr *ip6_hdr; struct ipv6_opt_hdr *hop; unsigned char buf[CALIPSO_MAX_BUFFER]; - int len_delta, new_end, pad; + int len_delta, new_end, pad, payload; unsigned int start, end; ip6_hdr = ipv6_hdr(skb); @@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, if (ret_val < 0) return ret_val; + ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */ + if (len_delta) { if (len_delta > 0) skb_push(skb, len_delta); @@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, sizeof(*ip6_hdr) + start); skb_reset_network_header(skb); ip6_hdr = ipv6_hdr(skb); + payload = ntohs(ip6_hdr->payload_len); + ip6_hdr->payload_len = htons(payload + len_delta); } hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1); |