ah: reload pointers to skb data after calling skb_cow_data() (4b0ef1f2) · Commits · 戴 / test

skb_cow_data() may allocate a new data buffer, so pointers on skb should be set after this function. Bug was introduced by commit ("ah4: convert to ahash") and ("ah6: convert to ahash"). Signed-off-by:

Wang Xuefu <xuefu.wang@6wind.com> Acked-by:

Krzysztof Witek <krzysztof.witek@6wind.com> Signed-off-by:

Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/ah4.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -314,14 +314,15 @@ static int ah_input(struct xfrm_state x, struct sk_buff skb)

		skb->ip_summed = CHECKSUM_NONE;

		ah = (struct ip_auth_hdr *)skb->data;
		iph = ip_hdr(skb);
		ihl = ip_hdrlen(skb);

		if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
		goto out;
		nfrags = err;

		ah = (struct ip_auth_hdr *)skb->data;
		iph = ip_hdr(skb);
		ihl = ip_hdrlen(skb);

		work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
		if (!work_iph)
		goto out;

net/ipv6/ah6.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -538,14 +538,16 @@ static int ah6_input(struct xfrm_state x, struct sk_buff skb)
		if (!pskb_may_pull(skb, ah_hlen))
		goto out;

		ip6h = ipv6_hdr(skb);

		skb_push(skb, hdr_len);

		if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
		goto out;
		nfrags = err;

		ah = (struct ip_auth_hdr *)skb->data;
		ip6h = ipv6_hdr(skb);

		skb_push(skb, hdr_len);

		work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
		if (!work_iph)
		goto out;

Admin message