Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ccfec9e5 authored by Paolo Abeni's avatar Paolo Abeni Committed by David S. Miller
Browse files

ip_tunnel: be careful when accessing the inner header 



Cong noted that we need the same checks introduced by commit 76c0ddd8
("ip6_tunnel: be careful when accessing the inner header")
even for ipv4 tunnels.

Fixes: c5441932 ("GRE: Refactor GRE tunneling code.")
Suggested-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d8e2262a

net/ipv4/ip_tunnel.c

+9 −0
Original line number Diff line number Diff line
@@ -627,6 +627,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, 
		    const struct iphdr *tnl_params, u8 protocol)

{

	struct ip_tunnel *tunnel = netdev_priv(dev);

	unsigned int inner_nhdr_len = 0;

	const struct iphdr *inner_iph;

	struct flowi4 fl4;

	u8     tos, ttl;
@@ -636,6 +637,14 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, 
	__be32 dst;

	bool connected;



	/* ensure we can access the inner net header, for several users below */

	if (skb->protocol == htons(ETH_P_IP))

		inner_nhdr_len = sizeof(struct iphdr);

	else if (skb->protocol == htons(ETH_P_IPV6))

		inner_nhdr_len = sizeof(struct ipv6hdr);

	if (unlikely(!pskb_may_pull(skb, inner_nhdr_len)))

		goto tx_error;



	inner_iph = (const struct iphdr *)skb_inner_network_header(skb);

	connected = (tunnel->parms.iph.daddr != 0);