Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e76b2b25 authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki Committed by David S. Miller
Browse files

[IPV6]: Do no rely on skb->dst before it is assigned. 



Because skb->dst is assigned in ip6_route_input(), it is really
bad to use it in hop-by-hop option handler(s).

Closes: Bug #8450 (Eric Sesterhenn <snakebyte@gmx.de>)
Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5bb1ab09

net/ipv6/exthdrs.c

+12 −4
Original line number Diff line number Diff line
@@ -660,6 +660,14 @@ EXPORT_SYMBOL_GPL(ipv6_invert_rthdr); 
  Hop-by-hop options.

 **********************************/



/*

 * Note: we cannot rely on skb->dst before we assign it in ip6_route_input().

 */

static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)

{

	return skb->dst ? ip6_dst_idev(skb->dst) : __in6_dev_get(skb->dev);

}



/* Router Alert as of RFC 2711 */



static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
@@ -688,25 +696,25 @@ static int ipv6_hop_jumbo(struct sk_buff **skbp, int optoff) 
	if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {

		LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",

			       nh[optoff+1]);

		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),

		IP6_INC_STATS_BH(ipv6_skb_idev(skb),

				 IPSTATS_MIB_INHDRERRORS);

		goto drop;

	}



	pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));

	if (pkt_len <= IPV6_MAXPLEN) {

		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);

		IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS);

		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);

		return 0;

	}

	if (ipv6_hdr(skb)->payload_len) {

		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);

		IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS);

		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);

		return 0;

	}



	if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {

		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INTRUNCATEDPKTS);

		IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INTRUNCATEDPKTS);

		goto drop;

	}