diff options
| author | Andrea Mayer <andrea.mayer@uniroma2.it> | 2019-11-16 18:05:52 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-11-16 23:18:32 +0300 |
| commit | 7f91ed8c4f4b6368b0603543bccb6b5fd10804e1 (patch) | |
| tree | 1f3160d93a6cc2d0e14b5ae4822cc99ef89864d9 /net | |
| parent | acb9bdc1482280b0164d638ecd416eff6f694e9c (diff) | |
| download | linux-7f91ed8c4f4b6368b0603543bccb6b5fd10804e1.tar.xz | |
seg6: fix srh pointer in get_srh()
pskb_may_pull may change pointers in header. For this reason, it is
mandatory to reload any pointer that points into skb header.
Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv6/seg6_local.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index 9d4f75e0d33a..5e3d7004d431 100644 --- a/net/ipv6/seg6_local.c +++ b/net/ipv6/seg6_local.c @@ -81,6 +81,11 @@ static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb) if (!pskb_may_pull(skb, srhoff + len)) return NULL; + /* note that pskb_may_pull may change pointers in header; + * for this reason it is necessary to reload them when needed. + */ + srh = (struct ipv6_sr_hdr *)(skb->data + srhoff); + if (!seg6_validate_srh(srh, len)) return NULL; |