Commit 55792258 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[XFRM]: esp: fix skb_tail_pointer conversion bug 



Fix incorrect switch of "trailer" skb by "skb" during skb_tail_pointer
conversion:

-       *(u8*)(trailer->tail - 1) = top_iph->protocol;
+       *(skb_tail_pointer(skb) - 1) = top_iph->protocol;

-       *(u8 *)(trailer->tail - 1) = *skb_network_header(skb);
+       *(skb_tail_pointer(skb) - 1) = *skb_network_header(skb);

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 56eb8882

net/ipv4/esp4.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -64,7 +64,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) 
	esph = (struct ip_esp_hdr *)(skb_network_header(skb) +

	esph = (struct ip_esp_hdr *)(skb_network_header(skb) +

				     top_iph->ihl * 4);

				     top_iph->ihl * 4);

	top_iph->tot_len = htons(skb->len + alen);

	top_iph->tot_len = htons(skb->len + alen);

	*(skb_tail_pointer(skb) - 1) = top_iph->protocol;

	*(skb_tail_pointer(trailer) - 1) = top_iph->protocol;





	/* this is non-NULL only with UDP Encapsulation */

	/* this is non-NULL only with UDP Encapsulation */

	if (x->encap) {

	if (x->encap) {

net/ipv6/esp6.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -91,7 +91,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb) 
	top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len);

	top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len);

	esph = (struct ipv6_esp_hdr *)skb_transport_header(skb);

	esph = (struct ipv6_esp_hdr *)skb_transport_header(skb);

	top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph));

	top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph));

	*(skb_tail_pointer(skb) - 1) = *skb_network_header(skb);

	*(skb_tail_pointer(trailer) - 1) = *skb_network_header(skb);

	*skb_network_header(skb) = IPPROTO_ESP;

	*skb_network_header(skb) = IPPROTO_ESP;





	esph->spi = x->id.spi;

	esph->spi = x->id.spi;

CRA Git | Maintained and supported by SUSTech CRA and CCSE