Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4b0ef1f2 authored by Dang Hongwu's avatar Dang Hongwu Committed by David S. Miller
Browse files

ah: reload pointers to skb data after calling skb_cow_data() 



skb_cow_data() may allocate a new data buffer, so pointers on
skb should be set after this function.

Bug was introduced by commit dff3bb06 ("ah4: convert to ahash")
and 8631e9bd ("ah6: convert to ahash").

Signed-off-by: default avatarWang Xuefu <xuefu.wang@6wind.com>
Acked-by: default avatarKrzysztof Witek <krzysztof.witek@6wind.com>
Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e44f3911

net/ipv4/ah4.c

+4 −3
Original line number Diff line number Diff line
@@ -314,14 +314,15 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb) 


	skb->ip_summed = CHECKSUM_NONE;



	ah = (struct ip_auth_hdr *)skb->data;

	iph = ip_hdr(skb);

	ihl = ip_hdrlen(skb);



	if ((err = skb_cow_data(skb, 0, &trailer)) < 0)

		goto out;

	nfrags = err;



	ah = (struct ip_auth_hdr *)skb->data;

	iph = ip_hdr(skb);

	ihl = ip_hdrlen(skb);



	work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);

	if (!work_iph)

		goto out;

net/ipv6/ah6.c

+5 −3
Original line number Diff line number Diff line
@@ -538,14 +538,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb) 
	if (!pskb_may_pull(skb, ah_hlen))

		goto out;



	ip6h = ipv6_hdr(skb);



	skb_push(skb, hdr_len);



	if ((err = skb_cow_data(skb, 0, &trailer)) < 0)

		goto out;

	nfrags = err;



	ah = (struct ip_auth_hdr *)skb->data;

	ip6h = ipv6_hdr(skb);



	skb_push(skb, hdr_len);



	work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);

	if (!work_iph)

		goto out;