diff options
| author | Eric Dumazet <edumazet@google.com> | 2013-05-18 12:36:03 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-05-20 11:18:52 +0400 |
| commit | 96f5a846bdd60986992228bc7dae94d4d8eaacc0 (patch) | |
| tree | 6f999dce0e017d8e14d4257af04fdd9226b7fd42 /net/ipv4/ip_gre.c | |
| parent | b423e9ae49d78ea3f53b131c8d5a6087aed16fd6 (diff) | |
| download | linux-96f5a846bdd60986992228bc7dae94d4d8eaacc0.tar.xz | |
ip_gre: fix a possible crash in ipgre_err()
Another fix needed in ipgre_err(), as parse_gre_header() might change
skb->head.
Bug added in commit c54419321455 (GRE: Refactor GRE tunneling code.)
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/ip_gre.c')
| -rw-r--r-- | net/ipv4/ip_gre.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c index c625e4dad4b0..2a83591492dd 100644 --- a/net/ipv4/ip_gre.c +++ b/net/ipv4/ip_gre.c @@ -235,7 +235,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info) */ struct net *net = dev_net(skb->dev); struct ip_tunnel_net *itn; - const struct iphdr *iph = (const struct iphdr *)skb->data; + const struct iphdr *iph; const int type = icmp_hdr(skb)->type; const int code = icmp_hdr(skb)->code; struct ip_tunnel *t; @@ -281,6 +281,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info) else itn = net_generic(net, ipgre_net_id); + iph = (const struct iphdr *)skb->data; t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi.flags, iph->daddr, iph->saddr, tpi.key); |