Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e3ebdb20 authored by Richard Haines's avatar Richard Haines Committed by David S. Miller
Browse files

net/ipv6: Fix CALIPSO causing GPF with datagram support 



When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the
IP header may have moved.

Also update the payload length after adding the CALIPSO option.

Signed-off-by: default avatarRichard Haines <richard_c_haines@btinternet.com>
Acked-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarHuw Davies <huw@codeweavers.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 59423815

net/ipv6/calipso.c

+5 −1
Original line number Diff line number Diff line
@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, 
	struct ipv6hdr *ip6_hdr;

	struct ipv6_opt_hdr *hop;

	unsigned char buf[CALIPSO_MAX_BUFFER];

	int len_delta, new_end, pad;

	int len_delta, new_end, pad, payload;

	unsigned int start, end;



	ip6_hdr = ipv6_hdr(skb);
@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, 
	if (ret_val < 0)

		return ret_val;



	ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */



	if (len_delta) {

		if (len_delta > 0)

			skb_push(skb, len_delta);
@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, 
			sizeof(*ip6_hdr) + start);

		skb_reset_network_header(skb);

		ip6_hdr = ipv6_hdr(skb);

		payload = ntohs(ip6_hdr->payload_len);

		ip6_hdr->payload_len = htons(payload + len_delta);

	}



	hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);