lkml.org 
[lkml]   [2007]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 48/69] IPV6: Do no rely on skb->dst before it is assigned.
    -stable review patch.  If anyone has any objections, please let us know.
    ---------------------

    From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

    Because skb->dst is assigned in ip6_route_input(), it is really
    bad to use it in hop-by-hop option handler(s).

    Closes: Bug #8450 (Eric Sesterhenn <snakebyte@gmx.de>)
    Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>

    ---
    net/ipv6/exthdrs.c | 16 ++++++++++++----
    1 file changed, 12 insertions(+), 4 deletions(-)

    --- linux-2.6.21.1.orig/net/ipv6/exthdrs.c
    +++ linux-2.6.21.1/net/ipv6/exthdrs.c
    @@ -652,6 +652,14 @@ EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);
    Hop-by-hop options.
    **********************************/

    +/*
    + * Note: we cannot rely on skb->dst before we assign it in ip6_route_input().
    + */
    +static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
    +{
    + return skb->dst ? ip6_dst_idev(skb->dst) : __in6_dev_get(skb->dev);
    +}
    +
    /* Router Alert as of RFC 2711 */

    static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
    @@ -678,25 +686,25 @@ static int ipv6_hop_jumbo(struct sk_buff
    if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
    LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
    skb->nh.raw[optoff+1]);
    - IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
    + IP6_INC_STATS_BH(ipv6_skb_idev(skb),
    IPSTATS_MIB_INHDRERRORS);
    goto drop;
    }

    pkt_len = ntohl(*(__be32*)(skb->nh.raw+optoff+2));
    if (pkt_len <= IPV6_MAXPLEN) {
    - IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
    + IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS);
    icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
    return 0;
    }
    if (skb->nh.ipv6h->payload_len) {
    - IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
    + IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS);
    icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
    return 0;
    }

    if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
    - IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INTRUNCATEDPKTS);
    + IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INTRUNCATEDPKTS);
    goto drop;
    }

    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-05-21 21:47    [W:2.062 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site