ip_gre: fix parsing gre header in ipgre_err (b0350d51) · Commits · 戴 / test

gre_parse_header stops parsing when csum_err is encountered, which means tpi->key is undefined and ip_tunnel_lookup will return NULL improperly. This patch introduce a NULL pointer as csum_err parameter. Even when csum_err is encountered, it won't return error and continue parsing gre header as expected. Fixes: ("gre: Remove support for sharing GRE protocol hook.") Reported-by:

Jiri Benc <jbenc@redhat.com> Signed-off-by:

Haishuang Yan <yanhaishuang@cmss.chinamobile.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/gre_demux.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -86,13 +86,14 @@ int gre_parse_header(struct sk_buff skb, struct tnl_ptk_info tpi,

		options = (__be32 *)(greh + 1);
		if (greh->flags & GRE_CSUM) {
		if (skb_checksum_simple_validate(skb)) {
		if (!skb_checksum_simple_validate(skb)) {
		skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
		null_compute_pseudo);
		} else if (csum_err) {
		*csum_err = true;
		return -EINVAL;
		}

		skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
		null_compute_pseudo);
		options++;
		}

net/ipv4/ip_gre.c

+3 −6

Original line number	Diff line number	Diff line
		@@ -232,13 +232,10 @@ static void gre_err(struct sk_buff *skb, u32 info)
		const int type = icmp_hdr(skb)->type;
		const int code = icmp_hdr(skb)->code;
		struct tnl_ptk_info tpi;
		bool csum_err = false;

		if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
		iph->ihl * 4) < 0) {
		if (!csum_err) /* ignore csum errors. */
		if (gre_parse_header(skb, &tpi, NULL, htons(ETH_P_IP),
		iph->ihl * 4) < 0)
		return;
		}

		if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
		ipv4_update_pmtu(skb, dev_net(skb->dev), info,

Admin message